CVE-2024-2364

AC-4 enforces information flow rules that can block unauthorized external access to files or directories.

Enforcing least-privilege permissions and authorization policies directly prevents unauthorized file/directory exposure.

Data-at-rest protections such as encryption or ACLs reduce the impact of unintended file exposure.

Explicit requirement to protect backups directly mitigates unauthorized exposure of backup files.

Logical segmentation and access protections stop external parties from reaching files that should remain internal.

Hardened configuration baselines commonly include file-system permission settings that limit external access.

Classification helps identify which backups need stricter handling, but does not enforce storage location or access restrictions.

Access control directly limits who can reach backup files, though it does not address how backups are created or stored.

A.5.18's provisioning, revocation, review and adjustment of logical access rights (incl. before/after role changes or termination) directly stops unauthorized actors from reaching the backup file per business/policy rules; the bounded remainder is backups whose exposure is not an access-rights decision at all (e.g. the file is world-readable on a public share with no identity check).