Assessment Objective

Determine if:

• access agreements are developed and documented for systems processing, storing, or transmitting CUI.
• access agreements are reviewed [Assignment: frequency] .
• access agreements are updated [Assignment: frequency] .
• individuals requiring access to CUI and systems processing, storing, or transmitting CUI sign appropriate access agreements prior to being granted access.
• individuals requiring access to CUI and systems processing, storing, or transmitting CUI re-sign access agreements to maintain access when access agreements have been updated or [Assignment: frequency] .

Assessment Methods

Examine

• Personnel security policy
• personnel security procedures
• procedures addressing access agreements for systems processing, storing, or transmitting CUI
• access control policy
• access control procedures
• access agreements (including non-disclosure agreements, acceptable use agreements, rules of behavior, and conflict-of-interest agreements)
• documentation of access agreement reviews, updates, and re-signing
• system security plan
• other relevant documents or records

Interview

• Personnel with personnel security responsibilities
• personnel who have signed and/or resigned access agreements
• personnel with information security responsibilities

Test

• Processes for reviewing, updating, and re-signing access agreements
• mechanisms supporting reviewing, updating, and re-signing of access agreements

Свързани задачи

• NIST -

  https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final