Assessment Objective

Determine if:

• PS-06a. access agreements are developed and documented for organizational systems;
• PS-06b. the access agreements are reviewed and updated [Assignment: frequency];
• PS-06c.
  • PS-06c.01 individuals requiring access to organizational information and systems sign appropriate access agreements prior to being granted access;
  • PS-06c.02 individuals requiring access to organizational information and systems re-sign access agreements to maintain access to organizational systems when access agreements have been updated or [Assignment: frequency].

Assessment Methods

Examine

• Personnel security policy
• personnel security procedures
• procedures addressing access agreements for organizational information and systems
• access control policy
• access control procedures
• access agreements (including non-disclosure agreements, acceptable use agreements, rules of behavior, and conflict-of-interest agreements)
• documentation of access agreement reviews, updates, and re-signing
• system security plan
• privacy plan
• other relevant documents or records

Interview

• Organizational personnel with personnel security responsibilities
• organizational personnel who have signed/resigned access agreements
• organizational personnel with information security and privacy responsibilities

Test

• Organizational processes for reviewing, updating, and re-signing access agreements
• mechanisms supporting the reviewing, updating, and re-signing of access agreements

Propojené úkoly

• NIST -

  https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final