CVE-2026-90441

AC-24 mandates that access control decisions are applied to each request, preventing bypass of authorization logic.

AC-25 requires a tamperproof, always-invoked reference monitor that ensures authorization checks cannot be omitted.

Access enforcement directly stops unauthorized actors from obtaining sensitive information.

Information flow enforcement structurally prevents sensitive data from reaching unauthorized recipients.

Least privilege reduces the set of actors who can reach sensitive information.

Protection of information at rest prevents unauthorized exposure of stored sensitive data.

Continuous monitoring of computing resources can detect resource exhaustion but does not itself enforce allocation limits.

PR.AA-01 supplies proper credential lifecycle controls that reduce unauthorized access paths, yet leaves many other exposure vectors (error messages, logging, side channels, etc.) unaddressed.

A.5.10 only requires awareness, a topic-specific acceptable-use policy stating expected behaviours/monitoring, and procedures referencing classification and other controls; per the owner's explicit rule on labelling and similar dependency-style clauses, this does not itself prevent exposure (CWE-200) unless access/DLP/etc. act on it.

Requiring the return of all physical and electronic assets plus secure deletion of organizational data from personal devices reduces the chance that sensitive information remains accessible to departing personnel.

A.5.12 only defines and communicates a classification scheme so that protection needs can be understood; per the owner's explicit rule, labeling/classification does not itself prevent exposure and requires other controls (e.g. access enforcement) to act on it.

By requiring classification labels and metadata on all information assets, the control makes it harder for sensitive data to be inadvertently exposed because downstream systems and users can recognize and enforce handling rules based on those labels.

Requiring encryption, access controls, and recipient authentication for transfers directly reduces the chance that sensitive data reaches an unauthorized observer.

Requiring formal authorization of every access request before rights are granted ensures that checks for required permissions are performed, preventing missing authorization checks from being introduced.