+AC-19(04) Restrictions for Classified Information

AC-19(04) Restrictions for Classified Information

Control

  1. Prohibit the use of unclassified mobile devices in facilities containing systems processing, storing, or transmitting classified information unless specifically permitted by the authorizing official; and
  2. Enforce the following restrictions on individuals permitted by the authorizing official to use unclassified mobile devices in facilities containing systems processing, storing, or transmitting classified information:
    1. Connection of unclassified mobile devices to classified systems is prohibited;
    2. Connection of unclassified mobile devices to unclassified systems requires approval from the authorizing official;
    3. Use of internal or external modems or wireless interfaces within the unclassified mobile devices is prohibited; and
    4. Unclassified mobile devices and the information stored on those devices are subject to random reviews and inspections by [Assignement: security officials] , and if classified information is found, the incident handling policy is followed.
  3. Restrict the connection of classified mobile devices to classified systems in accordance with [Assignement: security policies].

Discussion

None.

Assessment Objective

  1. the use of unclassified mobile devices in facilities containing systems processing, storing, or transmitting classified information is prohibited unless specifically permitted by the authorizing official;
    1. prohibition of the connection of unclassified mobile devices to classified systems is enforced on individuals permitted by an authorizing official to use unclassified mobile devices in facilities containing systems processing, storing, or transmitting classified information;
    2. approval by the authorizing official for the connection of unclassified mobile devices to unclassified systems is enforced on individuals permitted to use unclassified mobile devices in facilities containing systems processing, storing, or transmitting classified information;
    3. prohibition of the use of internal or external modems or wireless interfaces within unclassified mobile devices is enforced on individuals permitted by an authorizing official to use unclassified mobile devices in facilities containing systems processing, storing, or transmitting classified information;
      1. random review and inspection of unclassified mobile devices and the information stored on those devices by [Assignement: security officials] are enforced;
      2. following of the incident handling policy is enforced if classified information is found during a random review and inspection of unclassified mobile devices;
  3. the connection of classified mobile devices to classified systems is restricted in accordance with [Assignement: security policies].

Assessment Method

Examine

Access control policy incident handling policy procedures addressing access control for mobile devices system design documentation system configuration settings and associated documentation evidentiary documentation for random inspections and reviews of mobile devices system audit records system security plan other relevant documents or records

Interview

Organizational personnel responsible for random reviews/inspections of mobile devices organizational personnel using mobile devices in facilities containing systems processing, storing, or transmitting classified information organizational personnel with incident response responsibilities system/network administrators organizational personnel with information security responsibilities

1. Oversigt

1.1 Referencer

1.2 Identificerede krav

1.3 Relaterede reguleringer

2. Identificerede krav

Krav

3. Relaterede reguleringer

Reguleringer

Linkede sager

Sagslinks
is blocked by AC-19(04) Restrictions for Classified Information – Assessment Procedure