+SA-04(06) Use of Information Assurance Products

SA-04(06) Use of Information Assurance Products

Control

  1. Employ only government off-the-shelf or commercial off-the-shelf information assurance and information assurance-enabled information technology products that compose an NSA-approved solution to protect classified information when the networks used to transmit the information are at a lower classification level than the information being transmitted; and
  2. Ensure that these products have been evaluated and/or validated by NSA or in accordance with NSA-approved procedures.

Discussion

Commercial off-the-shelf IA or IA-enabled information technology products used to protect classified information by cryptographic means may be required to use NSA-approved key management. See [NSA CSFC](#3d575737-98cb-459d-b41c-d7e82b73ad78).

Assessment Objective

  1. only government off-the-shelf or commercial off-the-shelf information assurance and information assurance-enabled information technology products that compose an NSA-approved solution to protect classified information when the networks used to transmit the information are at a lower classification level than the information being transmitted are employed;
  2. these products have been evaluated and/or validated by NSA or in accordance with NSA-approved procedures.

Assessment Method

Examine

Supply chain risk management plan system and services acquisition policy procedures addressing the integration of security requirements, descriptions, and criteria into the acquisition process solicitation documents acquisition documentation acquisition contracts for the system, system component, or system service security configurations to be implemented by the developer of the system, system component, or system service service level agreements list of deployed IT products/solutions NSA-approved list system security plan other relevant documents or records

Interview

Organizational personnel with acquisition/contracting responsibilities organizational personnel with the responsibility to determine system security requirements organizational personnel responsible for ensuring information assurance products are NSA-approved and are evaluated and/or validated products in accordance with NSA-approved procedures organizational personnel with information security responsibilities

1. Přehled

1.1 Odkazy

1.2 Identifikované požadavky

1.3 Související regulace

2. Identifikované požadavky

Požadavky

3. Související regulace

Regulace

Propojené úkoly

Vazby
is blocked by SA-04(06) Use of Information Assurance Products – Assessment Procedure
is blocked by Information Assurance Enabled Products
is blocked by Commercial Off-The-Shelf (COTS) Security Solutions