Assessment Objective
Determine if:
- SC-43a. usage restrictions and implementation guidelines are established for [Assignment: components];
- SC-43b.
- SC-43b.[01] the use of [Assignment: components] is authorized within the system;
- SC-43b.[02] the use of [Assignment: components] is monitored within the system;
- SC-43b.[03] the use of [Assignment: components] is controlled within the system.
Assessment Methods
Examine
- System and communications protection policy
- usage restrictions
- procedures addressing usage restrictions
- implementation policy and procedures
- authorization records
- system monitoring records
- system audit records
- system security plan
- other relevant documents or records
Interview
- System/network administrators
- organizational personnel with information security responsibilities
- organizational personnel installing, configuring, and/or maintaining the system
Test
- Organizational processes for authorizing, monitoring, and controlling the use of components with usage restrictions
- mechanisms supporting and/or implementing, authorizing, monitoring, and controlling the use of components with usage restrictions
Propojené úkoly
| Typ vazby | Úkol |
|---|---|
| blocks | SC-43 Usage Restrictions |