The vendor shall disclose the general features and capabilities of the access policy. The generic capabilities should include the following:

1. (1) Software access controls.
2. (2) Hardware access controls.
3. (3) Effective password management.
4. (4) The protection abilities of a particular operating system.
5. (5) The general characteristics of supervisory access privileges.

As added by P.L.3-1997, SEC.332.