The security access policy that contains fixed security attributes that are used by the system to determine a user's access to a file or object is Mandatory Access Control (MAC). MAC is a type of access control model that assigns permissions to users and objects based on their security labels, which indicate their level of sensitivity or trustworthiness. MAC is enforced by the system or the network, rather than by the owner or the creator of the object, and it cannot be modified or overridden by the users. MAC can provide some benefits for security, such as enhancing the confidentiality and the integrity of the data, preventing unauthorized access or disclosure, and supporting the audit and compliance activities. MAC is commonly used in military or government environments, where the data is classified according to its level of sensitivity, such as top secret, secret, confidential, or unclassified. The users are granted security clearance based on their level of trustworthiness, such as their background, their role, or their need to know. The users can only access the objects that have the same or lower security classification than their security clearance, and the objects can only be accessed by the users that have the same or higher security clearance than their security classification. This is based on the concept of no read up and no write down, which requires that a user can only read data of lower or equal sensitivity level, and can only write data of higher or equal sensitivity level. MAC contains fixed security attributes that are used by the system to determine a user's access to a file or object, by using the following methods:
Assigning security labels to the users and the objects, which consist of a security classification and a set of security categories. The security classification indicates the level of sensitivity of the data, such as top secret, secret, confidential, or unclassified. The security categories indicate the subject matter or the scope of the data, such as nuclear, military, or intelligence. The security labels are attached to the users and the objects as metadata or tags, and they cannot be changed or removed by the users.
Comparing the security labels of the users and the objects, using a reference monitor or an access control matrix. The reference monitor is a software component that intercepts and evaluates the requests for access to the objects, and grants or denies the access based on the security labels of the users and the objects. The access control matrix is a data structure that lists the users and the objects, and the permissions that each user has on each object, based on the security labels of the users and the objects.

The information owner is the person who has the authority and responsibility for the data stored, processed, or transmitted by an Information System (IS). When a system contains data from multiple information owners, each information owner must provide input to the IS owner regarding the security requirements of the data, such as the classification, sensitivity, retention, and disposal of the data. The IS owner is the person who has the authority and responsibility for the operation and maintenance of the IS. The IS owner must ensure that the security requirements of the data are met and that the IS complies with the applicable laws and regulations. Reviewing the Security Assessment Report (SAR), developing and maintaining the System Security Plan (SSP), and moving the data to another IS are not the responsibilities of the information owner, but they may involve the information owner's participation or approval.

The first action for a security administrator who detects an intrusion on the network based on precursors and other indicators is to isolate and contain the intrusion. An intrusion is an unauthorized or malicious activity that attempts to compromise the security or the functionality of a system or a network. An intrusion can be detected by various methods, such as the analysis of the network traffic, the logs, the alerts, or the anomalies. Precursors and indicators are the signs or the evidence of an intrusion or an attempted intrusion. Precursors are the events or the activities that occur before or during an intrusion, such as the reconnaissance, the scanning, or the probing. Indicators are the events or the activities that occur after or as a result of an intrusion, such as the exploitation, the backdoor, or the payload. The first action for a security administrator who detects an intrusion on the network is to isolate and contain the intrusion, which means to disconnect or block the affected system or network from the rest of the environment and prevent the intrusion from spreading or causing more damage. Isolating and containing the intrusion can help protect the other systems or networks from being compromised, preserve the evidence for the investigation, and facilitate the recovery and the restoration of the normal operations.

Mandatory Access Control (MAC) is considered the most restrictive access control model because it enforces strict policies that are determined by the system or security administrator, rather than allowing users to make decisions about access.
In MAC, access to resources is governed by a centralized security policy. The system defines access controls based on classification levels (e.g., confidential, secret, top secret) and the user's clearance level, as well as specific labels on data. Users cannot change these permissions or grant access to others. This makes it more restrictive than the other models, as it leaves little room for user discretion.
The restrictions imposed by MAC are rigid and typically enforced in high-security environments, such as military or government systems, where data classification and security are critical.

In systems security engineering, the security principle of modularity provides isolated functions and data. Modularity means dividing a system into well-defined logical units that have clear boundaries and interfaces. This helps to reduce complexity, improve maintainability, and enhance security. By isolating functions and data, modularity prevents unauthorized access, limits the impact of failures, and facilitates testing and verification. Modularity also supports the principle of least privilege, which grants the minimum access required to perform a function.