Assessment Objective

Determine if:

• AC-01a.
  • AC-01a.[01] an access control policy is developed and documented;
  • AC-01a.[02] the access control policy is disseminated to [Assignment: personnel or roles];
  • AC-01a.[03] access control procedures to facilitate the implementation of the access control policy and associated controls are developed and documented;
  • AC-01a.[04] the access control procedures are disseminated to [Assignment: personnel or roles];
  • AC-01a.01
    • AC-01a.01(a)
      • AC-01a.01(a)[01] the [Selection (one or more): organization-level; mission/business process-level; system-level] access control policy addresses purpose;
      • AC-01a.01(a)[02] the [Selection (one or more): organization-level; mission/business process-level; system-level] access control policy addresses scope;
      • AC-01a.01(a)[03] the [Selection (one or more): organization-level; mission/business process-level; system-level] access control policy addresses roles;
      • AC-01a.01(a)[04] the [Selection (one or more): organization-level; mission/business process-level; system-level] access control policy addresses responsibilities;
      • AC-01a.01(a)[05] the [Selection (one or more): organization-level; mission/business process-level; system-level] access control policy addresses management commitment;
      • AC-01a.01(a)[06] the [Selection (one or more): organization-level; mission/business process-level; system-level] access control policy addresses coordination among organizational entities;
      • AC-01a.01(a)[07] the [Selection (one or more): organization-level; mission/business process-level; system-level] access control policy addresses compliance;
    • AC-01a.01(b) the [Selection (one or more): organization-level; mission/business process-level; system-level] access control policy is consistent with applicable laws, Executive Orders, directives, regulations, policies, standards, and guidelines;
• AC-01b. the [Assignment: official] is designated to manage the development, documentation, and dissemination of the access control policy and procedures;
• AC-01c.
  • AC-01c.01
    • AC-01c.01[01] the current access control policy is reviewed and updated [Assignment: frequency];
    • AC-01c.01[02] the current access control policy is reviewed and updated following [Assignment: events];
  • AC-01c.02
    • AC-01c.02[01] the current access control procedures are reviewed and updated [Assignment: frequency];
    • AC-01c.02[02] the current access control procedures are reviewed and updated following [Assignment: events].

Assessment Methods

Examine

• Access control policy and procedures
• system security plan
• privacy plan
• other relevant documents or records

Interview

• Organizational personnel with access control responsibilities
• organizational personnel with information security with information security and privacy responsibilities

Assessment Objective

Determine if:

• AC-02a.
  • AC-02a.[01] account types allowed for use within the system are defined and documented;
  • AC-02a.[02] account types specifically prohibited for use within the system are defined and documented;
• AC-02b. account managers are assigned;
• AC-02c. [Assignment: prerequisites and criteria] for group and role membership are required;
• AC-02d.
  • AC-02d.01 authorized users of the system are specified;
  • AC-02d.02 group and role membership are specified;
  • AC-02d.03
    • AC-02d.03[01] access authorizations (i.e., privileges) are specified for each account;
    • AC-02d.03[02] [Assignment: attributes (as required)] are specified for each account;
• AC-02e. approvals are required by [Assignment: personnel or roles] for requests to create accounts;
• AC-02f.
  • AC-02f.[01] accounts are created in accordance with [Assignment: policy, procedures, prerequisites, and criteria];
  • AC-02f.[02] accounts are enabled in accordance with [Assignment: policy, procedures, prerequisites, and criteria];
  • AC-02f.[03] accounts are modified in accordance with [Assignment: policy, procedures, prerequisites, and criteria];
  • AC-02f.[04] accounts are disabled in accordance with [Assignment: policy, procedures, prerequisites, and criteria];
  • AC-02f.[05] accounts are removed in accordance with [Assignment: policy, procedures, prerequisites, and criteria];
• AC-02g. the use of accounts is monitored;
• AC-02h.
  • AC-02h.01 account managers and [Assignment: personnel or roles] are notified within [Assignment: time period] when accounts are no longer required;
  • AC-02h.02 account managers and [Assignment: personnel or roles] are notified within [Assignment: time period] when users are terminated or transferred;
  • AC-02h.03 account managers and [Assignment: personnel or roles] are notified within [Assignment: time period] when system usage or the need to know changes for an individual;
• AC-02i.
  • AC-02i.01 access to the system is authorized based on a valid access authorization;
  • AC-02i.02 access to the system is authorized based on intended system usage;
  • AC-02i.03 access to the system is authorized based on [Assignment: attributes (as required)];
• AC-02j. accounts are reviewed for compliance with account management requirements [Assignment: frequency];
• AC-02k.
  • AC-02k.[01] a process is established for changing shared or group account authenticators (if deployed) when individuals are removed from the group;
  • AC-02k.[02] a process is implemented for changing shared or group account authenticators (if deployed) when individuals are removed from the group;
• AC-02l.
  • AC-02l.[01] account management processes are aligned with personnel termination processes;
  • AC-02l.[02] account management processes are aligned with personnel transfer processes.

Assessment Methods

Examine

• Access control policy
• personnel termination policy and procedure
• personnel transfer policy and procedure
• procedures for addressing account management
• system design documentation
• system configuration settings and associated documentation
• list of active system accounts along with the name of the individual associated with each account
• list of recently disabled system accounts and the name of the individual associated with each account
• list of conditions for group and role membership
• notifications of recent transfers, separations, or terminations of employees
• access authorization records
• account management compliance reviews
• system monitoring records
• system audit records
• system security plan
• privacy plan
• other relevant documents or records

Interview

• Organizational personnel with account management responsibilities
• system/network administrators
• organizational personnel with information security with information security and privacy responsibilities

Test

• Organizational processes for account management on the system
• mechanisms for implementing account management

Assessment Objective

Determine if:

• AC-02(01) the management of system accounts is supported using [Assignment: automated mechanisms].

Assessment Methods

Examine

• Access control policy
• procedures for addressing account management
• system design documentation
• system configuration settings and associated documentation
• system audit records
• system security plan
• other relevant documents or records

Interview

• Organizational personnel with account management responsibilities
• system/network administrators
• organizational personnel with information security with information security responsibilities
• system developers

Test

• Automated mechanisms for implementing account management functions

Assessment Objective

Determine if:

• AC-02(02) temporary and emergency accounts are automatically [Selection: remove; disable] after [Assignment: time period].

Assessment Methods

Examine

• Access control policy
• procedures for addressing account management
• system design documentation
• system configuration settings and associated documentation
• system-generated list of temporary accounts removed and/or disabled
• system-generated list of emergency accounts removed and/or disabled
• system audit records
• system security plan
• other relevant documents or records

Interview

• Organizational personnel with account management responsibilities
• system/network administrators
• organizational personnel with information security with information security responsibilities
• system developers

Test

• Automated mechanisms for implementing account management functions

Assessment Objective

Determine if:

• AC-02(03)(a) accounts are disabled within [Assignment: time period] when the accounts have expired;
• AC-02(03)(b) accounts are disabled within [Assignment: time period] when the accounts are no longer associated with a user or individual;
• AC-02(03)(c) accounts are disabled within [Assignment: time period] when the accounts are in violation of organizational policy;
• AC-02(03)(d) accounts are disabled within [Assignment: time period] when the accounts have been inactive for [Assignment: time period].

Assessment Methods

Examine

• Access control policy
• procedures for addressing account management
• system security plan
• system design documentation
• system configuration settings and associated documentation
• system-generated list of accounts removed
• system-generated list of emergency accounts disabled
• system audit records
• system security plan
• other relevant documents or records

Interview

• Organizational personnel with account management responsibilities
• system/network administrators
• organizational personnel with information security responsibilities
• system developers

Test

• Mechanisms for implementing account management functions

Assessment Objective

Determine if:

• AC-02(04)[01] account creation is automatically audited;
• AC-02(04)[02] account modification is automatically audited;
• AC-02(04)[03] account enabling is automatically audited;
• AC-02(04)[04] account disabling is automatically audited;
• AC-02(04)[05] account removal actions are automatically audited.

Assessment Methods

Examine

• Access control policy
• procedures addressing account management
• system design documentation
• system configuration settings and associated documentation
• notifications/alerts of account creation, modification, enabling, disabling, and removal actions
• system audit records
• system security plan
• other relevant documents or records

Interview

• Organizational personnel with account management responsibilities
• system/network administrators
• organizational personnel with information security responsibilities

Test

• Automated mechanisms implementing account management functions

Assessment Objective

Determine if:

• AC-02(05) users are required to log out when [Assignment: time period of expected inactivity or description of when to log out].

Assessment Methods

Examine

• Access control policy
• procedures addressing account management
• system design documentation
• system configuration settings and associated documentation
• security violation reports
• system audit records
• system security plan
• other relevant documents or records

Interview

• Organizational personnel with account management responsibilities
• system/network administrators
• organizational personnel with information security responsibilities
• users that must comply with inactivity logout policy

Assessment Objective

Determine if:

• AC-02(06) [Assignment: dynamic privilege management capabilities] are implemented.

Assessment Methods

Examine

• Access control policy
• procedures addressing account management
• system design documentation
• system configuration settings and associated documentation
• system-generated list of dynamic privilege management capabilities
• system audit records
• system security plan
• other relevant documents or records

Interview

• Organizational personnel with account management responsibilities
• system/network administrators
• organizational personnel with information security responsibilities
• system developers

Test

• system or mechanisms implementing dynamic privilege management capabilities

Assessment Objective

Determine if:

• AC-02(07)(a) privileged user accounts are established and administered in accordance with [Selection: a role-based access scheme; an attribute-based access scheme];
• AC-02(07)(b) privileged role or attribute assignments are monitored;
• AC-02(07)(c) changes to roles or attributes are monitored;
• AC-02(07)(d) access is revoked when privileged role or attribute assignments are no longer appropriate.

Assessment Methods

Examine

• Access control policy
• procedures addressing account management
• system design documentation
• system configuration settings and associated documentation
• system-generated list of privileged user accounts and associated roles
• records of actions taken when privileged role assignments are no longer appropriate
• system audit records
• audit tracking and monitoring reports
• system monitoring records
• system security plan
• other relevant documents or records

Interview

• Organizational personnel with account management responsibilities
• system/network administrators
• organizational personnel with information security responsibilities

Test

• Mechanisms implementing account management functions
• mechanisms monitoring privileged role assignments

Assessment Objective

Determine if:

• AC-02(08)[01] [Assignment: system accounts] are created dynamically;
• AC-02(08)[02] [Assignment: system accounts] are activated dynamically;
• AC-02(08)[03] [Assignment: system accounts] are managed dynamically;
• AC-02(08)[04] [Assignment: system accounts] are deactivated dynamically.

Assessment Methods

Examine

• Access control policy
• procedures addressing account management
• system design documentation
• system configuration settings and associated documentation
• system-generated list of system accounts
• system audit records
• system security plan
• other relevant documents or records

Interview

• Organizational personnel with account management responsibilities
• system/network administrators
• organizational personnel with information security responsibilities
• system developers

Test

• Automated mechanisms implementing account management functions

Assessment Objective

Determine if:

• AC-02(09) the use of shared and group accounts is only permitted if [Assignment: conditions] are met.

Assessment Methods

Examine

• Access control policy
• procedures addressing account management
• system design documentation
• system configuration settings and associated documentation
• system-generated list of shared/group accounts and associated roles
• system audit records
• system security plan
• other relevant documents or records

Interview

• Organizational personnel with account management responsibilities
• system/network administrators
• organizational personnel with information security responsibilities

Test

• Mechanisms implementing management of shared/group accounts

Assessment Objective

Determine if:

• AC-02(11) [Assignment: circumstances and/or usage conditions] for [Assignment: system accounts] are enforced.

Assessment Methods

Examine

• Access control policy
• procedures addressing account management
• system design documentation
• system configuration settings and associated documentation
• system-generated list of system accounts and associated assignments of usage circumstances and/or usage conditions
• system audit records
• system security plan
• other relevant documents or records

Interview

• Organizational personnel with account management responsibilities
• system/network administrators
• organizational personnel with information security responsibilities
• system developers

Test

• Mechanisms implementing account management functions

Assessment Objective

Determine if:

• AC-02(12)(a) system accounts are monitored for [Assignment: atypical usage];
• AC-02(12)(b) atypical usage of system accounts is reported to [Assignment: personnel or roles].

Assessment Methods

Examine

• Access control policy
• procedures addressing account management
• system design documentation
• system configuration settings and associated documentation
• system monitoring records
• system audit records
• audit tracking and monitoring reports
• privacy impact assessment
• system security plan
• privacy plan
• other relevant documents or records

Interview

• Organizational personnel with account management responsibilities
• system/network administrators
• organizational personnel with information security responsibilities

Test

• Mechanisms implementing account management functions

Assessment Objective

Determine if:

• AC-02(13) accounts of individuals are disabled within [Assignment: time period] of discovery of [Assignment: significant risks].

Assessment Methods

Examine

• Access control policy
• procedures addressing account management
• system design documentation
• system configuration settings and associated documentation
• system-generated list of disabled accounts
• list of user activities posing significant organizational risk
• system audit records
• system security plan
• other relevant documents or records

Interview

• Organizational personnel with account management responsibilities
• system/network administrators
• organizational personnel with information security responsibilities

Test

• Mechanisms implementing account management functions

Assessment Objective

Determine if:

• AC-03 approved authorizations for logical access to information and system resources are enforced in accordance with applicable access control policies.

Assessment Methods

Examine

• Access control policy
• procedures addressing access enforcement
• system design documentation
• system configuration settings and associated documentation
• list of approved authorizations (user privileges)
• system audit records
• system security plan
• privacy plan
• other relevant documents or records

Interview

• Organizational personnel with access enforcement responsibilities
• system/network administrators
• organizational personnel with information security and privacy responsibilities
• system developers

Test

• Mechanisms implementing access control policy

Assessment Objective

Determine if:

• AC-03(02) dual authorization is enforced for [Assignment: privileged commands and/or other actions].

Assessment Methods

Examine

• Access control policy
• procedures addressing access enforcement and dual authorization
• system design documentation
• system configuration settings and associated documentation
• list of privileged commands requiring dual authorization
• list of actions requiring dual authorization
• list of approved authorizations (user privileges)
• system security plan
• other relevant documents or records

Interview

• Organizational personnel with access enforcement responsibilities
• system/network administrators
• organizational personnel with information security responsibilities
• system developers

Test

• Dual authorization mechanisms implementing access control policy

Assessment Objective

Determine if:

• AC-03(03)[01] [Assignment: mandatory access control policy] is enforced over the set of covered subjects specified in the policy;
• AC-03(03)[02] [Assignment: mandatory access control policy] is enforced over the set of covered objects specified in the policy;
• AC-03(03)(a)
  • AC-03(03)(a)[01] [Assignment: mandatory access control policy] is uniformly enforced across the covered subjects within the system;
  • AC-03(03)(a)[02] [Assignment: mandatory access control policy] is uniformly enforced across the covered objects within the system;
• AC-03(03)(b)
  • AC-03(03)(b)(01) [Assignment: mandatory access control policy] and [Assignment: mandatory access control policy] specifying that a subject that has been granted access to information is constrained from passing the information to unauthorized subjects or objects are enforced;
  • AC-03(03)(b)(02) [Assignment: mandatory access control policy] and [Assignment: mandatory access control policy] specifying that a subject that has been granted access to information is constrained from granting its privileges to other subjects are enforced;
  • AC-03(03)(b)(03) [Assignment: mandatory access control policy] and [Assignment: mandatory access control policy] specifying that a subject that has been granted access to information is constrained from changing one of more security attributes (specified by the policy) on subjects, objects, the system, or system components are enforced;
  • AC-03(03)(b)(04) [Assignment: mandatory access control policy] and [Assignment: mandatory access control policy] specifying that a subject that has been granted access to information is constrained from choosing the security attributes and attribute values (specified by the policy) to be associated with newly created or modified objects are enforced;
  • AC-03(03)(b)(05) [Assignment: mandatory access control policy] and [Assignment: mandatory access control policy] specifying that a subject that has been granted access to information is constrained from changing the rules governing access control are enforced;
• AC-03(03)(c) [Assignment: mandatory access control policy] and [Assignment: mandatory access control policy] specifying that [Assignment: subjects] may explicitly be granted [Assignment: privileges] such that they are not limited by any defined subset (or all) of the above constraints are enforced.

Assessment Methods

Examine

• Access control policy
• mandatory access control policies
• procedures addressing access enforcement
• system design documentation
• system configuration settings and associated documentation
• list of subjects and objects (i.e., users and resources) requiring enforcement of mandatory access control policies
• system audit records
• system security plan
• other relevant documents or records

Interview

• Organizational personnel with access enforcement responsibilities
• system/network administrators
• organizational personnel with information security responsibilities
• system developers

Test

• Automated mechanisms implementing mandatory access control

Assessment Objective

Determine if:

• AC-03(04)[01] [Assignment: discretionary access control policy] is enforced over the set of covered subjects specified in the policy;
• AC-03(04)[02] [Assignment: discretionary access control policy] is enforced over the set of covered objects specified in the policy;
• AC-03(04)(a) [Assignment: discretionary access control policy] and [Assignment: discretionary access control policy] are enforced where the policy specifies that a subject that has been granted access to information can pass the information to any other subjects or objects;
• AC-03(04)(b) [Assignment: discretionary access control policy] and [Assignment: discretionary access control policy] are enforced where the policy specifies that a subject that has been granted access to information can grant its privileges to other subjects;
• AC-03(04)(c) [Assignment: discretionary access control policy] and [Assignment: discretionary access control policy] are enforced where the policy specifies that a subject that has been granted access to information can change security attributes on subjects, objects, the system, or the system’s components;
• AC-03(04)(d) [Assignment: discretionary access control policy] and [Assignment: discretionary access control policy] are enforced where the policy specifies that a subject that has been granted access to information can choose the security attributes to be associated with newly created or revised objects;
• AC-03(04)(e) [Assignment: discretionary access control policy] and [Assignment: discretionary access control policy] are enforced where the policy specifies that a subject that has been granted access to information can change the rules governing access control.

Assessment Methods

Examine

• Access control policy
• discretionary access control policies
• procedures addressing access enforcement
• system design documentation
• system configuration settings and associated documentation
• list of subjects and objects (i.e., users and resources) requiring enforcement of discretionary access control policies
• system audit records
• system security plan
• other relevant documents or records

Interview

• Organizational personnel with access enforcement responsibilities
• system/network administrators
• organizational personnel with information security responsibilities
• system developers

Test

• Mechanisms implementing discretionary access control policy

Assessment Objective

Determine if:

• AC-03(05) access to [Assignment: security-relevant information] is prevented except during secure, non-operable system states.

Assessment Methods

Examine

• Access control policy
• procedures addressing access enforcement
• system design documentation
• system configuration settings and associated documentation
• system audit records
• system security plan
• other relevant documents or records

Interview

• Organizational personnel with access enforcement responsibilities
• system/network administrators
• organizational personnel with information security responsibilities
• system developers

Test

• Mechanisms preventing access to security-relevant information within the system

Assessment Objective

Determine if:

• AC-03(07)[01] a role-based access control policy is enforced over defined subjects;
• AC-03(07)[02] a role-based access control policy is enforced over defined objects;
• AC-03(07)[03] access is controlled based on [Assignment: roles] and [Assignment: users authorized to assume such roles].

Assessment Methods

Examine

• Access control policy
• role-based access control policies
• procedures addressing access enforcement
• system design documentation
• system configuration settings and associated documentation
• list of roles, users, and associated privileges required to control system access
• system audit records
• system security plan
• privacy plan
• other relevant documents or records

Interview

• Organizational personnel with access enforcement responsibilities
• system/network administrators
• organizational personnel with information security and privacy responsibilities
• system developers

Test

• Mechanisms implementing role-based access control policy

Assessment Objective

Determine if:

• AC-03(08)[01] revocation of access authorizations is enforced, resulting from changes to the security attributes of subjects based on [Assignment: rules];
• AC-03(08)[02] revocation of access authorizations is enforced resulting from changes to the security attributes of objects based on [Assignment: rules].

Assessment Methods

Examine

• Access control policy
• procedures addressing access enforcement
• system design documentation
• system configuration settings and associated documentation
• rules governing revocation of access authorizations, system audit records
• system security plan
• other relevant documents or records

Interview

• Organizational personnel with access enforcement responsibilities
• system/network administrators
• organizational personnel with information security responsibilities
• system developers

Test

• Mechanisms implementing access enforcement functions

Assessment Objective

Determine if:

• AC-03(09)(a) information is released outside of the system only if the receiving [Assignment: system or system component] provides [Assignment: controls];
• AC-03(09)(b) information is released outside of the system only if [Assignment: controls] are used to validate the appropriateness of the information designated for release.

Assessment Methods

Examine

• Access control policy
• procedures addressing access enforcement
• system design documentation
• system configuration settings and associated documentation
• list of security and privacy safeguards provided by receiving system or system components
• list of security and privacy safeguards validating appropriateness of information designated for release
• system audit records
• results of period assessments (inspections/tests) of the external system
• information sharing agreements
• memoranda of understanding
• acquisitions/contractual agreements
• system security plan
• privacy plan
• other relevant documents or records

Interview

• Organizational personnel with access enforcement responsibilities
• system/network administrators
• organizational personnel with information security and privacy responsibilities
• organizational personnel with responsibility for acquisitions/contractual agreements
• legal counsel
• system developers

Test

• Mechanisms implementing access enforcement functions

Assessment Objective

Determine if:

• AC-03(10) an audited override of automated access control mechanisms is employed under [Assignment: conditions] by [Assignment: roles].

Assessment Methods

Examine

• Access control policy
• procedures addressing access enforcement
• system design documentation
• system configuration settings and associated documentation
• conditions for employing audited override of automated access control mechanisms
• system audit records
• system security plan
• other relevant documents or records

Interview

• Organizational personnel with access enforcement responsibilities
• system/network administrators
• organizational personnel with information security responsibilities

Test

• Mechanisms implementing access enforcement functions

Assessment Objective

Determine if:

• AC-03(11) access to data repositories containing [Assignment: information types] is restricted.

Assessment Methods

Examine

• Access control policy
• procedures addressing access enforcement
• system design documentation
• system configuration settings and associated documentation
• system audit records
• system security plan
• other relevant documents or records

Interview

• Organizational personnel with access enforcement responsibilities
• organizational personnel with responsibilities for data repositories
• system/network administrators
• organizational personnel with information security responsibilities

Test

• Mechanisms implementing access enforcement functions

Assessment Objective

Determine if:

• AC-03(12)(a) as part of the installation process, applications are required to assert the access needed to the following system applications and functions: [Assignment: system applications and functions];
• AC-03(12)(b) an enforcement mechanism to prevent unauthorized access is provided;
• AC-03(12)(c) access changes after initial installation of the application are approved.

Assessment Methods

Examine

• Access control policy
• procedures addressing access enforcement
• system design documentation
• system configuration settings and associated documentation
• system audit records
• system security plan
• other relevant documents or records

Interview

• Organizational personnel with access enforcement responsibilities
• system/network administrators
• organizational personnel with information security responsibilities

Test

• Mechanisms implementing access enforcement functions

Assessment Objective

Determine if:

• AC-03(13)[01] the attribute-based access control policy is enforced over defined subjects;
• AC-03(13)[02] the attribute-based access control policy is enforced over defined objects;
• AC-03(13)[03] access is controlled based on [Assignment: attributes].

Assessment Methods

Examine

• Access control policy
• procedures addressing access enforcement
• system design documentation
• system configuration settings and associated documentation
• list of subjects and objects (i.e., users and resources) requiring enforcement of attribute-based access control policies
• system audit records
• system security plan
• other relevant documents or records

Interview

• Organizational personnel with access enforcement responsibilities
• system/network administrators
• organizational personnel with information security responsibilities

Test

• Mechanisms implementing access enforcement functions

Assessment Objective

Determine if:

• AC-03(14) [Assignment: mechanisms] are provided to enable individuals to have access to [Assignment: elements] of their personally identifiable information.

Assessment Methods

Examine

• Access mechanisms (e.g., request forms and application interfaces)
• access control policy
• procedures addressing access enforcement
• system design documentation
• system configuration settings and associated documentation
• documentation regarding access to an individual’s personally identifiable information
• system audit records
• system security plan
• privacy plan
• privacy impact assessment
• privacy assessment findings and/or reports
• other relevant documents or records

Interview

• Organizational personnel with access enforcement responsibilities
• system/network administrators
• organizational personnel with information security and privacy responsibilities
• legal counsel

Test

• Mechanisms implementing access enforcement functions
• mechanisms enabling individual access to personally identifiable information

Assessment Objective

Determine if:

• AC-03(15)(a)
  • AC-03(15)(a)[01] [Assignment: mandatory access control policy] is enforced over the set of covered subjects specified in the policy;
  • AC-03(15)(a)[02] [Assignment: mandatory access control policy] is enforced over the set of covered objects specified in the policy;
• AC-03(15)(b)
  • AC-03(15)(b)[01] [Assignment: discretionary access control policy] is enforced over the set of covered subjects specified in the policy;
  • AC-03(15)(b)[02] [Assignment: discretionary access control policy] is enforced over the set of covered objects specified in the policy.

Assessment Methods

Examine

• Access control policy
• procedures addressing access enforcement
• system design documentation
• system configuration settings and associated documentation
• list of subjects and objects (i.e., users and resources) requiring enforcement of mandatory access control policies
• list of subjects and objects (i.e., users and resources) requiring enforcement of discretionary access control policies
• system audit records
• system security plan
• other relevant documents or records

Interview

• Organizational personnel with access enforcement responsibilities
• system/network administrators
• organizational personnel with information security responsibilities
• system developers

Test

• Mechanisms implementing mandatory and discretionary access control policy

Assessment Objective

Determine if:

• AC-04 approved authorizations are enforced for controlling the flow of information within the system and between connected systems based on [Assignment: information flow control policies].

Assessment Methods

Examine

• Access control policy
• information flow control policies
• procedures addressing information flow enforcement
• security architecture documentation
• privacy architecture documentation
• system design documentation
• system configuration settings and associated documentation
• system baseline configuration
• list of information flow authorizations
• system audit records
• system security plan
• privacy plan
• other relevant documents or records

Interview

• System/network administrators
• organizational personnel with information security and privacy architecture development responsibilities
• organizational personnel with information security and privacy responsibilities
• system developers

Test

• Mechanisms implementing information flow enforcement policy

Assessment Objective

Determine if:

• AC-04(01)[01] [Assignment: security attributes] associated with [Assignment: information objects], [Assignment: source objects] , and [Assignment: destination objects] are used to enforce [Assignment: information flow control policies] as a basis for flow control decisions;
• AC-04(01)[02] [Assignment: privacy attributes] associated with [Assignment: information objects], [Assignment: source objects] , and [Assignment: destination objects] are used to enforce [Assignment: information flow control policies] as a basis for flow control decisions.

Assessment Methods

Examine

• Access control policy
• information flow control policies
• procedures addressing information flow enforcement
• system design documentation
• system configuration settings and associated documentation
• list of security and privacy attributes and associated source and destination objects
• system audit records
• system security plan
• privacy plan
• other relevant documents or records

Interview

• System/network administrators
• organizational personnel with information security responsibilities
• organizational personnel with privacy responsibilities
• system developers

Test

• Mechanisms implementing information flow enforcement policy

Assessment Objective

Determine if:

• AC-04(02) protected processing domains are used to enforce [Assignment: information flow control policies] as a basis for flow control decisions.

Assessment Methods

Examine

• Access control policy
• information flow control policies
• procedures addressing information flow enforcement
• system design documentation
• system security architecture and associated documentation
• system configuration settings and associated documentation
• system audit records
• system security plan
• other relevant documents or records

Interview

• System/network administrators
• organizational personnel with information security responsibilities

Test

• Mechanisms implementing information flow enforcement policy

Assessment Objective

Determine if:

• AC-04(03) [Assignment: information flow control policies] are enforced.

Assessment Methods

Examine

• Access control policy
• information flow control policies
• procedures addressing information flow enforcement
• system design documentation
• system security architecture and associated documentation
• system configuration settings and associated documentation
• system audit records
• system security plan
• other relevant documents or records

Interview

• System/network administrators
• organizational personnel with information security responsibilities
• system developers

Test

• Mechanisms implementing information flow enforcement policy

Assessment Objective

Determine if:

• AC-04(04) encrypted information is prevented from bypassing [Assignment: information flow control mechanisms] by [Selection (one or more): decrypting the information; blocking the flow of the encrypted information; terminating communications sessions attempting to pass encrypted information; [Assignment: organization-defined procedure or method] ].

Assessment Methods

Examine

• Access control policy
• information flow control policies
• procedures addressing information flow enforcement
• system design documentation
• system configuration settings and associated documentation
• system audit records
• system security plan
• other relevant documents or records

Interview

• System/network administrators
• organizational personnel with information security responsibilities
• system developers

Test

• Mechanisms implementing information flow enforcement policy

Assessment Objective

Determine if:

• AC-04(05) [Assignment: limitations] are enforced on embedding data types within other data types.

Assessment Methods

Examine

• Access control policy
• procedures addressing information flow enforcement
• system design documentation
• system configuration settings and associated documentation
• list of limitations to be enforced on embedding data types within other data types
• system audit records
• system security plan
• other relevant documents or records

Interview

• System/network administrators
• organizational personnel with information security responsibilities
• system developers

Test

• Mechanisms implementing information flow enforcement policy

Assessment Objective

Determine if:

• AC-04(06) information flow control enforcement is based on [Assignment: metadata].

Assessment Methods

Examine

• Access control policy
• information flow control policies
• procedures addressing information flow enforcement
• system design documentation
• system configuration settings and associated documentation
• types of metadata used to enforce information flow control decisions
• system audit records
• system security plan
• other relevant documents or records

Interview

• System/network administrators
• organizational personnel with information security responsibilities
• system developers

Test

• Mechanisms implementing information flow enforcement policy

Assessment Objective

Determine if:

• AC-04(07) one-way information flows are enforced through hardware-based flow control mechanisms.

Assessment Methods

Examine

• Access control policy
• information flow control policies
• procedures addressing information flow enforcement
• system design documentation
• system configuration settings and associated documentation
• system hardware mechanisms and associated configurations
• system audit records
• system security plan
• other relevant documents or records

Interview

• System/network administrators
• organizational personnel with information security responsibilities
• system developers

Test

• Hardware mechanisms implementing information flow enforcement policy

Assessment Objective

Determine if:

• AC-04(08)(a)
  • AC-04(08)(a)[01] information flow control is enforced using [Assignment: security policy filter] as a basis for flow control decisions for [Assignment: information flows];
  • AC-04(08)(a)[02] information flow control is enforced using [Assignment: privacy policy filter] as a basis for flow control decisions for [Assignment: information flows];
• AC-04(08)(b) [Selection (one or more): block; strip; modify; quarantine] data after a filter processing failure in accordance with [Assignment: security policy]; [Selection (one or more): block; strip; modify; quarantine] data after a filter processing failure in accordance with [Assignment: privacy policy].

Assessment Methods

Examine

• Access control policy
• information flow control policies
• procedures addressing information flow enforcement
• system design documentation
• system configuration settings and associated documentation
• list of security policy filters regulating flow control decisions
• list of privacy policy filters regulating flow control decisions
• system audit records
• system security plan
• privacy plan
• other relevant documents or records

Interview

• System/network administrators
• organizational personnel with information security and privacy responsibilities
• system developers

Test

• Mechanisms implementing information flow enforcement policy
• security and privacy policy filters

Assessment Objective

Determine if:

• AC-04(09) human reviews are used for [Assignment: information flows] under [Assignment: conditions].

Assessment Methods

Examine

• Access control policy
• information flow control policies
• procedures addressing information flow enforcement
• system design documentation
• system configuration settings and associated documentation
• records of human reviews regarding information flows
• list of information flows requiring the use of human reviews
• list of conditions requiring human reviews for information flows
• system audit records
• system security plan
• privacy plan
• other relevant documents or records

Interview

• System/network administrators
• organizational personnel with information security and privacy responsibilities
• organizational personnel with information flow enforcement responsibilities
• system developers

Test

• Mechanisms enforcing the use of human reviews

Assessment Objective

Determine if:

• AC-04(10)[01] capability is provided for privileged administrators to enable and disable [Assignment: security filters] under [Assignment: conditions];
• AC-04(10)[02] capability is provided for privileged administrators to enable and disable [Assignment: privacy filters] under [Assignment: conditions].

Assessment Methods

Examine

• Access control policy
• information flow information policies
• procedures addressing information flow enforcement
• system design documentation
• system configuration settings and associated documentation
• list of security policy filters enabled/disabled by privileged administrators
• list of privacy policy filters enabled/disabled by privileged administrators
• list of approved data types for enabling/disabling by privileged administrators
• system audit records
• system security plan
• privacy plan
• other relevant documents or records

Interview

• Organizational personnel with responsibilities for enabling/disabling security and privacy policy filters
• system/network administrators
• organizational personnel with information security and privacy responsibilities
• system developers

Test

• Mechanisms implementing information flow enforcement policy
• security and privacy policy filters

Assessment Objective

Determine if:

• AC-04(11)[01] capability is provided for privileged administrators to configure [Assignment: security policy filters] to support different security or privacy policies;
• AC-04(11)[02] capability is provided for privileged administrators to configure [Assignment: privacy policy filters] to support different security or privacy policies.

Assessment Methods

Examine

• Access control policy
• information flow control policies
• procedures addressing information flow enforcement
• system design documentation
• system configuration settings and associated documentation
• list of security policy filters
• list of privacy policy filters
• system audit records
• system security plan
• privacy plan
• other relevant documents or records

Interview

• Organizational personnel with responsibilities for configuring security and privacy policy filters
• system/network administrators
• organizational personnel with information security and privacy responsibilities
• system developers

Test

• Mechanisms implementing information flow enforcement policy
• security and privacy policy filters

Assessment Objective

Determine if:

• AC-04(12) when transferring information between different security domains, [Assignment: data type identifiers] are used to validate data essential for information flow decisions.

Assessment Methods

Examine

• Access control policy
• information flow control policies
• procedures addressing information flow enforcement
• system design documentation
• system configuration settings and associated documentation
• list of data type identifiers
• system audit records
• system security plan
• other relevant documents or records

Interview

• System/network administrators
• organizational personnel with information security responsibilities
• system developers

Test

• Mechanisms implementing information flow enforcement policy

Assessment Objective

Determine if:

• AC-04(13) when transferring information between different security domains, information is decomposed into [Assignment: policy-relevant subcomponents] for submission to policy enforcement mechanisms.

Assessment Methods

Examine

• Access control policy
• information flow control policies
• procedures addressing information flow enforcement
• system design documentation
• system configuration settings and associated documentation
• system audit records
• system security plan
• other relevant documents or records

Interview

• System/network administrators
• organizational personnel with information security responsibilities
• system developers

Test

• Mechanisms implementing information flow enforcement policy

Assessment Objective

Determine if:

• AC-04(14)[01] when transferring information between different security domains, implemented [Assignment: security policy filters] require fully enumerated formats that restrict data structure and content;
• AC-04(14)[02] when transferring information between different security domains, implemented [Assignment: privacy policy filters] require fully enumerated formats that restrict data structure and content.

Assessment Methods

Examine

• Access control policy
• information flow control policies
• procedures addressing information flow enforcement
• system design documentation
• system configuration settings and associated documentation
• list of security and privacy policy filters
• list of data structure policy filters
• list of data content policy filters
• system audit records
• system security plan
• privacy plan
• other relevant documents or records

Interview

• System/network administrators
• organizational personnel with information security and privacy responsibilities
• system developers

Test

• Mechanisms implementing information flow enforcement policy
• security and privacy policy filters

Assessment Objective

Determine if:

• AC-04(15)[01] when transferring information between different security domains, information is examined for the presence of [Assignment: unsanctioned information];
• AC-04(15)[02] when transferring information between different security domains, transfer of [Assignment: unsanctioned information] is prohibited in accordance with the [Assignment: security policy];
• AC-04(15)[03] when transferring information between different security domains, transfer of [Assignment: unsanctioned information] is prohibited in accordance with the [Assignment: privacy policy].

Assessment Methods

Examine

• Access control policy
• information flow control policies
• procedures addressing information flow enforcement
• system design documentation
• system configuration settings and associated documentation
• list of unsanctioned information types and associated information
• system audit records
• system security plan
• privacy plan
• other relevant documents or records

Interview

• Organizational personnel with information security responsibilities
• organizational personnel with privacy responsibilities
• system developers

Test

• Mechanisms implementing information flow enforcement policy

Assessment Objective

Determine if:

• AC-04(17) source and destination points are uniquely identified and authenticated by [Selection (one or more): organization, system, application, service, individual] for information transfer.

Assessment Methods

Examine

• Access control policy
• information flow control policies
• procedures addressing information flow enforcement
• procedures addressing source and destination domain identification and authentication
• system design documentation
• system configuration settings and associated documentation
• system audit records
• list of system labels
• system security plan
• privacy plan
• other relevant documents or records

Interview

• System/network administrators
• organizational personnel with information security and privacy responsibilities
• system developers

Test

• Mechanisms implementing information flow enforcement policy

Assessment Objective

Determine if:

• AC-04(19)[01] when transferring information between different security domains, [Assignment: security policy filters] are implemented on metadata;
• AC-04(19)[02] when transferring information between different security domains, [Assignment: privacy policy filters] are implemented on metadata.

Assessment Methods

Examine

• Information flow enforcement policy
• information flow control policies
• procedures addressing information flow enforcement
• system design documentation
• system configuration settings and associated documentation
• list of security policy filtering criteria applied to metadata and data payloads
• system audit records
• system security plan
• privacy plan
• other relevant documents or records

Interview

• Organizational personnel with information flow enforcement responsibilities
• system/network administrators
• organizational personnel with information security responsibilities
• organizational personnel with privacy responsibilities
• system developers

Test

• Mechanisms implementing information flow enforcement functions
• security and policy filters

Assessment Objective

Determine if:

• AC-04(20) [Assignment: solutions in approved configurations] are employed to control the flow of [Assignment: information] across security domains.

Assessment Methods

Examine

• Information flow enforcement policy
• information flow control policies
• procedures addressing information flow enforcement
• system design documentation
• system configuration settings and associated documentation
• list of solutions in approved configurations
• approved configuration baselines
• system audit records
• system security plan
• other relevant documents or records

Interview

• Organizational personnel with information flow enforcement responsibilities
• system/network administrators
• organizational personnel with information security responsibilities

Test

• Mechanisms implementing information flow enforcement functions

Assessment Objective

Determine if:

• AC-04(21)[01] information flows are separated logically using [Assignment: mechanisms and/or techniques] to accomplish [Assignment: required separations];
• AC-04(21)[02] information flows are separated physically using [Assignment: mechanisms and/or techniques] to accomplish [Assignment: required separations].

Assessment Methods

Examine

• Information flow enforcement policy
• information flow control policies
• procedures addressing information flow enforcement
• system design documentation
• system configuration settings and associated documentation
• list of required separation of information flows by information types
• list of mechanisms and/or techniques used to logically or physically separate information flows
• system audit records
• system security plan
• other relevant documents or records

Interview

• Organizational personnel with information flow enforcement responsibilities
• system/network administrators
• organizational personnel with information security responsibilities
• system developers

Test

• Mechanisms implementing information flow enforcement functions

Assessment Objective

Determine if:

• AC-04(22) access is provided from a single device to computing platforms, applications, or data that reside in multiple different security domains while preventing information flow between the different security domains.

Assessment Methods

Examine

• Information flow enforcement policy
• procedures addressing information flow enforcement
• system design documentation
• system configuration settings and associated documentation
• system audit records
• system security plan
• other relevant documents or records

Interview

• Organizational personnel with information flow enforcement responsibilities
• system/network administrators
• organizational personnel with information security responsibilities

Test

• Mechanisms implementing information flow enforcement functions

Assessment Objective

Determine if:

• AC-04(23) when transferring information between security domains, non-releasable information is modified by implementing [Assignment: modification action].

Assessment Methods

Examine

• Information flow enforcement policy
• procedures addressing information flow enforcement
• system design documentation
• system configuration settings and associated documentation
• system audit records
• system security plan
• other relevant documents or records

Interview

• Organizational personnel with information flow enforcement responsibilities
• system/network administrators
• organizational personnel with information security responsibilities

Test

• Mechanisms implementing information flow enforcement functions

Assessment Objective

Determine if:

• AC-04(24)[01] when transferring information between different security domains, incoming data is parsed into an internal, normalized format;
• AC-04(24)[02] when transferring information between different security domains, the data is regenerated to be consistent with its intended specification.

Assessment Methods

Examine

• Information flow enforcement policy
• procedures addressing information flow enforcement
• system design documentation
• system configuration settings and associated documentation
• system audit records
• system security plan
• other relevant documents or records

Interview

• Organizational personnel with information flow enforcement responsibilities
• system/network administrators
• organizational personnel with information security responsibilities

Test

• Mechanisms implementing information flow enforcement functions

Assessment Objective

Determine if:

• AC-04(25) when transferring information between different security domains, data is sanitized to minimize [Selection (one or more): delivery of malicious content, command and control of malicious code, malicious code augmentation, and steganography-encoded data; spillage of sensitive information] in accordance with [Assignment: policy].

Assessment Methods

Examine

• Information flow enforcement policy
• procedures addressing information flow enforcement
• system design documentation
• system configuration settings and associated documentation
• system audit records
• system security plan
• other relevant documents or records

Interview

• Organizational personnel with information flow enforcement responsibilities
• system/network administrators
• organizational personnel with information security responsibilities

Test

• Mechanisms implementing information flow enforcement functions

Assessment Objective

Determine if:

• AC-04(26)[01] when transferring information between different security domains, content-filtering actions are recorded and audited;
• AC-04(26)[02] when transferring information between different security domains, results for the information being filtered are recorded and audited.

Assessment Methods

Examine

• Information flow enforcement policy
• procedures addressing information flow enforcement
• system design documentation
• system configuration settings and associated documentation
• system audit records
• system security plan
• other relevant documents or records

Interview

• Organizational personnel with information flow enforcement responsibilities
• system/network administrators
• organizational personnel with information security responsibilities

Test

• Mechanisms implementing information flow enforcement functions
• mechanisms implementing content filtering
• mechanisms recording and auditing content filtering

Assessment Objective

Determine if:

• AC-04(27) when transferring information between security domains, implemented content filtering solutions provide redundant and independent filtering mechanisms for each data type.

Assessment Methods

Examine

• Information flow enforcement policy
• procedures addressing information flow enforcement
• system design documentation
• system configuration settings and associated documentation
• system audit records
• system security plan
• other relevant documents or records

Interview

• Organizational personnel with information flow enforcement responsibilities
• system/network administrators
• organizational personnel with information security responsibilities

Test

• Mechanisms implementing information flow enforcement functions

Assessment Objective

Determine if:

• AC-04(28) when transferring information between security domains, a linear content filter pipeline is implemented that is enforced with discretionary and mandatory access controls.

Assessment Methods

Examine

• Information flow enforcement policy
• procedures addressing information flow enforcement
• system design documentation
• system configuration settings and associated documentation
• system audit records
• system security plan
• other relevant documents or records

Interview

• Organizational personnel with information flow enforcement responsibilities
• system/network administrators
• organizational personnel with information security responsibilities

Test

• Mechanisms implementing information flow enforcement functions
• mechanisms implementing linear content filters

Assessment Objective

Determine if:

• AC-04(29)(a) when transferring information between security domains, content filter orchestration engines are employed to ensure that content-filtering mechanisms successfully complete execution without errors;
• AC-04(29)(b)
  • AC-04(29)(b)[01] when transferring information between security domains, content filter orchestration engines are employed to ensure that content-filtering actions occur in the correct order;
  • AC-04(29)(b)[02] when transferring information between security domains, content filter orchestration engines are employed to ensure that content-filtering actions comply with [Assignment: policy].

Assessment Methods

Examine

• Information flow enforcement policy
• procedures addressing information flow enforcement
• system design documentation
• system configuration settings and associated documentation
• system audit records
• system security plan
• other relevant documents or records

Interview

• Organizational personnel with information flow enforcement responsibilities
• system/network administrators
• organizational personnel with information security responsibilities

Test

• Mechanisms implementing information flow enforcement functions
• mechanisms implementing content filter orchestration engines

Assessment Objective

Determine if:

• AC-04(30) when transferring information between security domains, content-filtering mechanisms using multiple processes are implemented.

Assessment Methods

Examine

• Information flow enforcement policy
• procedures addressing information flow enforcement
• system design documentation
• system configuration settings and associated documentation
• system audit records
• system security plan
• other relevant documents or records

Interview

• Organizational personnel with information flow enforcement responsibilities
• system/network administrators
• organizational personnel with information security responsibilities

Test

• Mechanisms implementing information flow enforcement functions
• mechanisms implementing content filtering

Assessment Objective

Determine if:

• AC-04(31) when transferring information between different security domains, the transfer of failed content to the receiving domain is prevented.

Assessment Methods

Examine

• Information flow enforcement policy
• procedures addressing information flow enforcement
• system design documentation
• system configuration settings and associated documentation
• system audit records
• system security plan
• other relevant documents or records

Interview

• Organizational personnel with information flow enforcement responsibilities
• system/network administrators
• organizational personnel with information security responsibilities

Test

• Mechanisms implementing information flow enforcement functions

Assessment Objective

Determine if:

• AC-04(32)(a) when transferring information between different security domains, the process that transfers information between filter pipelines does not filter message content;
• AC-04(32)(b) when transferring information between different security domains, the process that transfers information between filter pipelines validates filtering metadata;
• AC-04(32)(c) when transferring information between different security domains, the process that transfers information between filter pipelines ensures that the content with the filtering metadata has successfully completed filtering;
• AC-04(32)(d) when transferring information between different security domains, the process that transfers information between filter pipelines transfers the content to the destination filter pipeline.

Assessment Methods

Examine

• Information flow enforcement policy
• procedures addressing information flow enforcement
• system design documentation
• system configuration settings and associated documentation
• system audit records
• system security plan
• other relevant documents or records

Interview

• Organizational personnel with information flow enforcement responsibilities
• system/network administrators
• organizational personnel with information security responsibilities

Test

• Mechanisms implementing information flow enforcement functions
• mechanisms implementing content filtering

Assessment Objective

Determine if:

• AC-05a. [Assignment: duties of individuals] are identified and documented;
• AC-05b. system access authorizations to support separation of duties are defined.

Assessment Methods

Examine

• Access control policy
• procedures addressing divisions of responsibility and separation of duties
• system configuration settings and associated documentation
• list of divisions of responsibility and separation of duties
• system access authorizations
• system audit records
• system security plan
• other relevant documents or records

Interview

• Organizational personnel with responsibilities for defining appropriate divisions of responsibility and separation of duties
• organizational personnel with information security responsibilities
• system/network administrators

Test

• Mechanisms implementing separation of duties policy

Assessment Objective

Determine if:

• AC-06 the principle of least privilege is employed, allowing only authorized accesses for users (or processes acting on behalf of users) that are necessary to accomplish assigned organizational tasks.

Assessment Methods

Examine

• Access control policy
• procedures addressing least privilege
• list of assigned access authorizations (user privileges)
• system configuration settings and associated documentation
• system audit records
• system security plan
• other relevant documents or records

Interview

• Organizational personnel with responsibilities for defining least privileges necessary to accomplish specified tasks
• organizational personnel with information security responsibilities
• system/network administrators

Test

• Mechanisms implementing least privilege functions

Assessment Objective

Determine if:

• AC-06(01)(a)
  • AC-06(01)(a)[01] access is authorized for [Assignment: individuals and roles] to [Assignment: security functions (deployed in hardware)];
  • AC-06(01)(a)[02] access is authorized for [Assignment: individuals and roles] to [Assignment: security functions (deployed in software)];
  • AC-06(01)(a)[03] access is authorized for [Assignment: individuals and roles] to [Assignment: security functions (deployed in firmware)];
• AC-06(01)(b) access is authorized for [Assignment: individuals and roles] to [Assignment: security-relevant information].

Assessment Methods

Examine

• Access control policy
• procedures addressing least privilege
• list of security functions (deployed in hardware, software, and firmware) and security-relevant information for which access must be explicitly authorized
• system configuration settings and associated documentation
• system audit records
• system security plan
• other relevant documents or records

Interview

• Organizational personnel with responsibilities for defining least privileges necessary to accomplish specified tasks
• organizational personnel with information security responsibilities
• system/network administrators

Test

• Mechanisms implementing least privilege functions

Assessment Objective

Determine if:

• AC-06(02) users of system accounts (or roles) with access to [Assignment: security functions or security-relevant information] are required to use non-privileged accounts or roles when accessing non-security functions.

Assessment Methods

Examine

• Access control policy
• procedures addressing least privilege
• list of system-generated security functions or security-relevant information assigned to system accounts or roles
• system configuration settings and associated documentation
• system audit records
• system security plan
• other relevant documents or records

Interview

• Organizational personnel with responsibilities for defining least privileges necessary to accomplish specified tasks
• organizational personnel with information security responsibilities
• system/network administrators

Test

• Mechanisms implementing least privilege functions

Assessment Objective

Determine if:

• AC-06(03)[01] network access to [Assignment: privileged commands] is authorized only for [Assignment: compelling operational needs];
• AC-06(03)[02] the rationale for authorizing network access to privileged commands is documented in the security plan for the system.

Assessment Methods

Examine

• Access control policy
• procedures addressing least privilege
• system configuration settings and associated documentation
• system audit records
• list of operational needs for authorizing network access to privileged commands
• system security plan
• other relevant documents or records

Interview

• Organizational personnel with responsibilities for defining least privileges necessary to accomplish specified tasks
• organizational personnel with information security responsibilities

Test

• Mechanisms implementing least privilege functions

Assessment Objective

Determine if:

• AC-06(04) separate processing domains are provided to enable finer-grain allocation of user privileges.

Assessment Methods

Examine

• Access control policy
• procedures addressing least privilege
• system design documentation
• system configuration settings and associated documentation
• system audit records
• system security plan
• other relevant documents or records

Interview

• Organizational personnel with responsibilities for defining least privileges necessary to accomplish specified tasks
• organizational personnel with information security responsibilities
• system developers

Test

• Mechanisms implementing least privilege functions

Assessment Objective

Determine if:

• AC-06(05) privileged accounts on the system are restricted to [Assignment: personnel or roles].

Assessment Methods

Examine

• Access control policy
• procedures addressing least privilege
• list of system-generated privileged accounts
• list of system administration personnel
• system configuration settings and associated documentation
• system audit records
• system security plan
• other relevant documents or records

Interview

• Organizational personnel with responsibilities for defining least privileges necessary to accomplish specified tasks
• organizational personnel with information security responsibilities
• system/network administrators

Test

• Mechanisms implementing least privilege functions

Assessment Objective

Determine if:

• AC-06(06) privileged access to the system by non-organizational users is prohibited.

Assessment Methods

Examine

• Access control policy
• procedures addressing least privilege
• list of system-generated privileged accounts
• list of non-organizational users
• system configuration settings and associated documentation
• audit records
• system security plan
• other relevant documents or records

Interview

• Organizational personnel with responsibilities for defining least privileges necessary to accomplish specified tasks
• organizational personnel with information security responsibilities
• system/network administrators

Test

• Mechanisms prohibiting privileged access to the system

Assessment Objective

Determine if:

• AC-06(07)(a) privileges assigned to [Assignment: roles and classes] are reviewed [Assignment: frequency] to validate the need for such privileges;
• AC-06(07)(b) privileges are reassigned or removed, if necessary, to correctly reflect organizational mission and business needs.

Assessment Methods

Examine

• Access control policy
• procedures addressing least privilege
• list of system-generated roles or classes of users and assigned privileges
• system design documentation
• system configuration settings and associated documentation
• validation reviews of privileges assigned to roles or classes or users
• records of privilege removals or reassignments for roles or classes of users
• system audit records
• system security plan
• other relevant documents or records

Interview

• Organizational personnel with responsibilities for reviewing least privileges necessary to accomplish specified tasks
• organizational personnel with information security responsibilities
• system/network administrators

Test

• Mechanisms implementing review of user privileges

Assessment Objective

Determine if:

• AC-06(08) [Assignment: software] is prevented from executing at higher privilege levels than users executing the software.

Assessment Methods

Examine

• Access control policy
• procedures addressing least privilege
• list of software that should not execute at higher privilege levels than users executing software
• system design documentation
• system configuration settings and associated documentation
• system audit records
• system security plan
• other relevant documents or records

Interview

• Organizational personnel with responsibilities for defining least privileges necessary to accomplish specified tasks
• organizational personnel with information security responsibilities
• system/network administrators
• system developers

Test

• Mechanisms implementing least privilege functions for software execution

Assessment Objective

Determine if:

• AC-06(09) the execution of privileged functions is logged.

Assessment Methods

Examine

• Access control policy
• procedures addressing least privilege
• system design documentation
• system configuration settings and associated documentation
• list of privileged functions to be audited
• list of audited events
• system audit records
• system security plan
• other relevant documents or records

Interview

• Organizational personnel with responsibilities for reviewing least privileges necessary to accomplish specified tasks
• organizational personnel with information security responsibilities
• system/network administrators
• system developers

Test

• Mechanisms auditing the execution of least privilege functions

Assessment Objective

Determine if:

• AC-06(10) non-privileged users are prevented from executing privileged functions.

Assessment Methods

Examine

• Access control policy
• procedures addressing least privilege
• system design documentation
• system configuration settings and associated documentation
• list of privileged functions and associated user account assignments
• system audit records
• system security plan
• other relevant documents or records

Interview

• Organizational personnel with responsibilities for defining least privileges necessary to accomplish specified tasks
• organizational personnel with information security responsibilities
• system developers

Test

• Mechanisms implementing least privilege functions for non-privileged users

Assessment Objective

Determine if:

• AC-07a. a limit of [Assignment: number] consecutive invalid logon attempts by a user during [Assignment: time period] is enforced;
• AC-07b. automatically [Selection (one or more): lock the account or node for [Assignment: time period] ; lock the account or node until released by an administrator; delay next logon prompt per [Assignment: delay algorithm] ; notify system administrator; take other [Assignment: action] ] when the maximum number of unsuccessful attempts is exceeded.

Assessment Methods

Examine

• Access control policy
• procedures addressing unsuccessful logon attempts
• system design documentation
• system configuration settings and associated documentation
• system audit records
• system security plan
• other relevant documents or records

Interview

• Organizational personnel with information security responsibilities
• system developers
• system/network administrators

Test

• Mechanisms implementing access control policy for unsuccessful logon attempts

Assessment Objective

Determine if:

• AC-07(02) information is purged or wiped from [Assignment: mobile devices] based on [Assignment: purging or wiping requirements and techniques] after [Assignment: number] consecutive, unsuccessful device logon attempts.

Assessment Methods

Examine

• Access control policy
• procedures addressing unsuccessful logon attempts on mobile devices
• system design documentation
• system configuration settings and associated documentation
• list of mobile devices to be purged/wiped after organization-defined consecutive, unsuccessful device logon attempts
• list of purging/wiping requirements or techniques for mobile devices
• system audit records
• system security plan
• other relevant documents or records

Interview

• System/network administrators
• organizational personnel with information security responsibilities

Test

• Mechanisms implementing access control policy for unsuccessful device logon attempts

Assessment Objective

Determine if:

• AC-07(03) unsuccessful biometric logon attempts are limited to [Assignment: number].

Assessment Methods

Examine

• Access control policy
• procedures addressing unsuccessful logon attempts on biometric devices
• system design documentation
• system configuration settings and associated documentation
• system audit records
• system security plan
• other relevant documents or records

Interview

• System/network administrators
• organizational personnel with information security responsibilities

Test

• Mechanisms implementing access control policy for unsuccessful logon attempts

Assessment Objective

Determine if:

• AC-07(04)(a) [Assignment: authentication factors] that are different from the primary authentication factors are allowed to be used after the number of organization-defined consecutive invalid logon attempts have been exceeded;
• AC-07(04)(b) a limit of [Assignment: number] consecutive invalid logon attempts through the use of the alternative factors by the user during a [Assignment: time period] is enforced.

Assessment Methods

Examine

• Access control policy
• procedures addressing unsuccessful logon attempts for primary and alternate authentication factors
• system design documentation
• system configuration settings and associated documentation
• system audit records
• system security plan
• other relevant documents or records

Interview

• System/network administrators
• organizational personnel with information security responsibilities

Test

• Mechanisms implementing access control policy for unsuccessful logon attempts

Assessment Objective

Determine if:

• AC-08a. [Assignment: system use notification] is displayed to users before granting access to the system that provides privacy and security notices consistent with applicable laws, Executive Orders, directives, regulations, policies, standards, and guidelines;
  • AC-08a.01 the system use notification states that users are accessing a U.S. Government system;
  • AC-08a.02 the system use notification states that system usage may be monitored, recorded, and subject to audit;
  • AC-08a.03 the system use notification states that unauthorized use of the system is prohibited and subject to criminal and civil penalties; and
  • AC-08a.04 the system use notification states that use of the system indicates consent to monitoring and recording;
• AC-08b. the notification message or banner is retained on the screen until users acknowledge the usage conditions and take explicit actions to log on to or further access the system;
• AC-08c.
  • AC-08c.01 for publicly accessible systems, system use information [Assignment: conditions] is displayed before granting further access to the publicly accessible system;
  • AC-08c.02 for publicly accessible systems, any references to monitoring, recording, or auditing that are consistent with privacy accommodations for such systems that generally prohibit those activities are displayed;
  • AC-08c.03 for publicly accessible systems, a description of the authorized uses of the system is included.

Assessment Methods

Examine

• Access control policy
• privacy and security policies, procedures addressing system use notification
• documented approval of system use notification messages or banners
• system audit records
• user acknowledgements of notification message or banner
• system design documentation
• system configuration settings and associated documentation
• system use notification messages
• system security plan
• privacy plan
• privacy impact assessment
• privacy assessment report
• other relevant documents or records

Interview

• System/network administrators
• organizational personnel with information security and privacy responsibilities
• legal counsel
• system developers

Test

• Mechanisms implementing system use notification

Assessment Objective

Determine if:

• AC-09 the user is notified, upon successful logon to the system, of the date and time of the last logon.

Assessment Methods

Examine

• Access control policy
• procedures addressing previous logon notification
• system design documentation
• system configuration settings and associated documentation
• system notification messages
• system security plan
• other relevant documents or records

Interview

• System/network administrators
• organizational personnel with information security responsibilities
• system developers

Test

• Mechanisms implementing access control policy for previous logon notification

Assessment Objective

Determine if:

• AC-09(01) the user is notified, upon successful logon, of the number of unsuccessful logon attempts since the last successful logon.

Assessment Methods

Examine

• Access control policy
• procedures addressing previous logon notification
• system design documentation
• system configuration settings and associated documentation
• system audit records
• system security plan
• other relevant documents or records

Interview

• System/network administrators
• organizational personnel with information security responsibilities
• system developers

Test

• Mechanisms implementing access control policy for previous logon notification

Assessment Objective

Determine if:

• AC-09(02) the user is notified, upon successful logon, of the number of [Selection: successful logons; unsuccessful logon attempts; both] during [Assignment: time period].

Assessment Methods

Examine

• Access control policy
• procedures addressing previous logon notification
• system design documentation
• system configuration settings and associated documentation
• system audit records
• system security plan
• other relevant documents or records

Interview

• System/network administrators
• organizational personnel with information security responsibilities
• system developers

Test

• Mechanisms implementing access control policy for previous logon notification

Assessment Objective

Determine if:

• AC-09(03) the user is notified, upon successful logon, of changes to [Assignment: security-related characteristics or parameters] during [Assignment: time period].

Assessment Methods

Examine

• Access control policy
• procedures addressing previous logon notification
• system design documentation
• system configuration settings and associated documentation
• system audit records
• system security plan
• other relevant documents or records

Interview

• System/network administrators
• organizational personnel with information security responsibilities
• system developers

Test

• Mechanisms implementing access control policy for previous logon notification

Assessment Objective

Determine if:

• AC-09(04) the user is notified, upon successful logon, of [Assignment: additional information].

Assessment Methods

Examine

• Access control policy
• procedures addressing previous logon notification
• system design documentation
• system configuration settings and associated documentation
• system audit records
• system security plan
• other relevant documents or records

Interview

• System/network administrators
• organizational personnel with information security responsibilities
• system developers

Test

• Mechanisms implementing access control policy for previous logon notification

Assessment Objective

Determine if:

• AC-10 the number of concurrent sessions for each [Assignment: account and/or account types] is limited to [Assignment: number].

Assessment Methods

Examine

• Access control policy
• procedures addressing concurrent session control
• system design documentation
• system configuration settings and associated documentation
• security plan
• system security plan
• other relevant documents or records

Interview

• System/network administrators
• organizational personnel with information security responsibilities
• system developers

Test

• Mechanisms implementing access control policy for concurrent session control

Assessment Objective

Determine if:

• AC-11a. further access to the system is prevented by [Selection (one or more): initiating a device lock after [Assignment: time period] of inactivity; requiring the user to initiate a device lock before leaving the system unattended];
• AC-11b. device lock is retained until the user re-establishes access using established identification and authentication procedures.

Assessment Methods

Examine

• Access control policy
• procedures addressing session lock
• procedures addressing identification and authentication
• system design documentation
• system configuration settings and associated documentation
• security plan
• system security plan
• other relevant documents or records

Interview

• System/network administrators
• organizational personnel with information security responsibilities
• system developers

Test

• Mechanisms implementing access control policy for session lock

Assessment Objective

Determine if:

• AC-11(01) information previously visible on the display is concealed, via device lock, with a publicly viewable image.

Assessment Methods

Examine

• Access control policy
• procedures addressing session lock
• display screen with session lock activated
• system design documentation
• system configuration settings and associated documentation
• system security plan
• other relevant documents or records

Interview

• System/network administrators
• organizational personnel with information security responsibilities
• system developers

Test

• System session lock mechanisms

Assessment Objective

Determine if:

• AC-12 a user session is automatically terminated after [Assignment: conditions or trigger events].

Assessment Methods

Examine

• Access control policy
• procedures addressing session termination
• system design documentation
• system configuration settings and associated documentation
• list of conditions or trigger events requiring session disconnect
• system audit records
• system security plan
• other relevant documents or records

Interview

• System/network administrators
• organizational personnel with information security responsibilities
• system developers

Test

• Automated mechanisms implementing user session termination

Assessment Objective

Determine if:

• AC-12(01) a logout capability is provided for user-initiated communications sessions whenever authentication is used to gain access to [Assignment: information resources].

Assessment Methods

Examine

• Access control policy
• procedures addressing session termination
• user logout messages
• system design documentation
• system configuration settings and associated documentation
• system audit records
• system security plan
• other relevant documents or records

Interview

• System/network administrators
• organizational personnel with information security responsibilities
• system developers

Test

• System session termination mechanisms
• logout capabilities for user-initiated communications sessions

Assessment Objective

Determine if:

• AC-12(02) an explicit logout message is displayed to users indicating the termination of authenticated communication sessions.

Assessment Methods

Examine

• Access control policy
• procedures addressing session termination
• user logout messages
• system design documentation
• system configuration settings and associated documentation
• system audit records
• system security plan
• other relevant documents or records

Interview

• System/network administrators
• organizational personnel with information security responsibilities
• system developers

Test

• System session termination mechanisms
• display of logout messages

Assessment Objective

Determine if:

• AC-12(03) an explicit message to users is displayed indicating that the session will end in [Assignment: time].

Assessment Methods

Examine

• Access control policy
• procedures addressing session termination
• time until end of session messages
• system design documentation
• system configuration settings and associated documentation
• system audit records
• system security plan
• other relevant documents or records

Interview

• System/network administrators
• organizational personnel with information security responsibilities
• system developers

Test

• System session termination mechanisms
• display of end of session time

Assessment Objective

Determine if:

• AC-14a. [Assignment: user actions] that can be performed on the system without identification or authentication consistent with organizational mission and business functions are identified;
• AC-14b.
  • AC-14b.[01] user actions not requiring identification or authentication are documented in the security plan for the system;
  • AC-14b.[02] a rationale for user actions not requiring identification or authentication is provided in the security plan for the system.

Assessment Methods

Examine

• Access control policy
• procedures addressing permitted actions without identification or authentication
• system configuration settings and associated documentation
• security plan
• list of user actions that can be performed without identification or authentication
• system audit records
• system security plan
• other relevant documents or records

Interview

• System/network administrators
• organizational personnel with information security responsibilities

Assessment Objective

Determine if:

• AC-16a.
  • AC-16a.[01] the means to associate [Assignment: types of security attributes] with [Assignment: security attribute values] for information in storage, in process, and/or in transmission are provided;
  • AC-16a.[02] the means to associate [Assignment: types of privacy attributes] with [Assignment: privacy attribute values] for information in storage, in process, and/or in transmission are provided;
• AC-16b.
  • AC-16b.[01] attribute associations are made;
  • AC-16b.[02] attribute associations are retained with the information;
• AC-16c.
  • AC-16c.[01] the following permitted security attributes are established from the attributes defined in AC-16_ODP[01] for [Assignment: systems]: [Assignment: security attributes];
  • AC-16c.[02] the following permitted privacy attributes are established from the attributes defined in AC-16_ODP[02] for [Assignment: systems]: [Assignment: privacy attributes];
• AC-16d. the following permitted attribute values or ranges for each of the established attributes are determined: [Assignment: attribute values or ranges];
• AC-16e. changes to attributes are audited;
• AC-16f.
  • AC-16f.[01] [Assignment: security attributes] are reviewed for applicability [Assignment: frequency];
  • AC-16f.[02] [Assignment: privacy attributes] are reviewed for applicability [Assignment: frequency].

Assessment Methods

Examine

• Access control policy
• procedures addressing the association of security and privacy attributes to information in storage, in process, and in transmission
• system design documentation
• system configuration settings and associated documentation
• system audit records
• system security plan
• privacy plan
• other relevant documents or records

Interview

• System/network administrators
• organizational personnel with information security and privacy responsibilities
• system developers

Test

• Organizational capability supporting and maintaining the association of security and privacy attributes to information in storage, in process, and in transmission

Assessment Objective

Determine if:

• AC-16(01)[01] security attributes are dynamically associated with [Assignment: subjects] in accordance with the following security policies as information is created and combined: [Assignment: security policies];
• AC-16(01)[02] security attributes are dynamically associated with [Assignment: objects] in accordance with the following security policies as information is created and combined: [Assignment: security policies];
• AC-16(01)[03] privacy attributes are dynamically associated with [Assignment: subjects] in accordance with the following privacy policies as information is created and combined: [Assignment: privacy policies];
• AC-16(01)[04] privacy attributes are dynamically associated with [Assignment: objects] in accordance with the following privacy policies as information is created and combined: [Assignment: privacy policies].

Assessment Methods

Examine

• Access control policy
• procedures addressing dynamic association of security and privacy attributes to information
• system design documentation
• system configuration settings and associated documentation
• system audit records
• system security plan
• privacy plan
• other relevant documents or records

Interview

• System/network administrators
• organizational personnel with information security and privacy responsibilities
• system developers

Test

• Automated mechanisms implementing dynamic association of security and privacy attributes to information

Assessment Objective

Determine if:

• AC-16(02)[01] authorized individuals (or processes acting on behalf of individuals) are provided with the capability to define or change the value of associated security attributes;
• AC-16(02)[02] authorized individuals (or processes acting on behalf of individuals) are provided with the capability to define or change the value of associated privacy attributes.

Assessment Methods

Examine

• Access control policy
• procedures addressing the change of security and privacy attribute values
• system design documentation
• system configuration settings and associated documentation
• list of individuals authorized to change security and privacy attributes
• system audit records
• system security plan
• privacy plan
• other relevant documents or records

Interview

• Organizational personnel with responsibilities for changing values of security and privacy attributes
• organizational personnel with information security and privacy responsibilities
• system developers

Test

• Mechanisms permitting changes to values of security and privacy attributes

Assessment Objective

Determine if:

• AC-16(03)[01] the association and integrity of [Assignment: security attributes] to [Assignment: subjects] is maintained;
• AC-16(03)[02] the association and integrity of [Assignment: security attributes] to [Assignment: objects] is maintained.
• AC-16(03)[03] the association and integrity of [Assignment: privacy attributes] to [Assignment: subjects] is maintained;
• AC-16(03)[04] the association and integrity of [Assignment: privacy attributes] to [Assignment: objects] is maintained.

Assessment Methods

Examine

• Access control policy
• procedures addressing the association of security and privacy attributes to information
• procedures addressing labeling or marking
• system design documentation
• system configuration settings and associated documentation
• system security plan
• privacy plan
• other relevant documents or records

Interview

• Organizational personnel with information security and privacy responsibilities
• system developers

Test

• Mechanisms maintaining association and integrity of security and privacy attributes to information

Assessment Objective

Determine if:

• AC-16(04)[01] authorized individuals (or processes acting on behalf of individuals) are provided with the capability to associate [Assignment: security attributes] with [Assignment: subjects];
• AC-16(04)[02] authorized individuals (or processes acting on behalf of individuals) are provided with the capability to associate [Assignment: security attributes] with [Assignment: objects];
• AC-16(04)[03] authorized individuals (or processes acting on behalf of individuals) are provided with the capability to associate [Assignment: privacy attributes] with [Assignment: subjects];
• AC-16(04)[04] authorized individuals (or processes acting on behalf of individuals) are provided with the capability to associate [Assignment: privacy attributes] with [Assignment: objects].

Assessment Methods

Examine

• Access control policy
• procedures addressing the association of security and privacy attributes to information
• system design documentation
• system configuration settings and associated documentation
• list of users authorized to associate security and privacy attributes to information
• system prompts for privileged users to select security and privacy attributes to be associated with information objects
• system audit records
• system security plan
• privacy plan
• other relevant documents or records

Interview

• Organizational personnel with responsibilities for associating security and privacy attributes to information
• organizational personnel with information security and privacy responsibilities
• system developers

Test

• Mechanisms supporting user associations of security and privacy attributes to information

Assessment Objective

Determine if:

• AC-16(05)[01] security attributes are displayed in human-readable form on each object that the system transmits to output devices to identify [Assignment: instructions] using [Assignment: naming conventions];
• AC-16(05)[02] privacy attributes are displayed in human-readable form on each object that the system transmits to output devices to identify [Assignment: instructions] using [Assignment: naming conventions].

Assessment Methods

Examine

• Access control policy
• procedures addressing display of security and privacy attributes in human-readable form
• special dissemination, handling, or distribution instructions
• types of human-readable, standard naming conventions
• system design documentation
• system configuration settings and associated documentation
• system audit records
• system security plan
• privacy plan
• other relevant documents or records

Interview

• Organizational personnel with information security and privacy responsibilities
• system developers

Test

• System output devices displaying security and privacy attributes in human-readable form on each object

Assessment Objective

Determine if:

• AC-16(06)[01] personnel are required to associate and maintain the association of [Assignment: security attributes] with [Assignment: subjects] in accordance with [Assignment: security policies];
• AC-16(06)[02] personnel are required to associate and maintain the association of [Assignment: security attributes] with [Assignment: objects] in accordance with [Assignment: security policies];
• AC-16(06)[03] personnel are required to associate and maintain the association of [Assignment: privacy attributes] with [Assignment: subjects] in accordance with [Assignment: privacy policies];
• AC-16(06)[04] personnel are required to associate and maintain the association of [Assignment: privacy attributes] with [Assignment: objects] in accordance with [Assignment: privacy policies].

Assessment Methods

Examine

• Access control policy
• procedures addressing association of security and privacy attributes with subjects and objects
• system security plan
• privacy plan
• other relevant documents or records

Interview

• Organizational personnel with responsibilities for associating and maintaining association of security and privacy attributes with subjects and objects
• organizational personnel with information security and privacy responsibilities
• system developers

Test

• Mechanisms supporting associations of security and privacy attributes to subjects and objects

Assessment Objective

Determine if:

• AC-16(07)[01] a consistent interpretation of security attributes transmitted between distributed system components is provided;
• AC-16(07)[02] a consistent interpretation of privacy attributes transmitted between distributed system components is provided.

Assessment Methods

Examine

• Access control policies and procedures
• procedures addressing consistent interpretation of security and privacy attributes transmitted between distributed system components
• procedures addressing access enforcement
• procedures addressing information flow enforcement
• system design documentation
• system configuration settings and associated documentation
• system audit records
• system security plan
• privacy access control policy
• other relevant documents or records

Interview

• Organizational personnel with responsibilities for providing consistent interpretation of security and privacy attributes used in access enforcement and information flow enforcement actions
• organizational personnel with information security and privacy responsibilities
• system developers

Test

• Mechanisms implementing access enforcement and information flow enforcement functions

Assessment Objective

Determine if:

• AC-16(08)[01] [Assignment: techniques and technologies] are implemented in associating security attributes to information;
• AC-16(08)[02] [Assignment: techniques and technologies] are implemented in associating privacy attributes to information.

Assessment Methods

Examine

• Access control policy
• procedures addressing association of security and privacy attributes to information
• system design documentation
• system configuration settings and associated documentation
• system audit records
• system security plan
• privacy plan
• other relevant documents or records

Interview

• Organizational personnel with responsibilities for associating security and privacy attributes to information
• organizational personnel with information security and privacy responsibilities
• system developers

Test

• Mechanisms implementing techniques or technologies associating security and privacy attributes to information

Assessment Objective

Determine if:

• AC-16(09)[01] security attributes associated with information are changed only via regrading mechanisms validated using [Assignment: techniques or procedures];
• AC-16(09)[02] privacy attributes associated with information are changed only via regrading mechanisms validated using [Assignment: techniques or procedures].

Assessment Methods

Examine

• Access control policy
• procedures addressing reassignment of security attributes to information
• system design documentation
• system configuration settings and associated documentation
• system audit records
• system security plan
• privacy plan
• other relevant documents or records

Interview

• Organizational personnel with responsibilities for reassigning association of security and privacy attributes to information
• organizational personnel with information security and privacy responsibilities
• system developers

Test

• Mechanisms implementing techniques or procedures for reassigning association of security and privacy attributes to information

Assessment Objective

Determine if:

• AC-16(10)[01] authorized individuals are provided with the capability to define or change the type and value of security attributes available for association with subjects and objects;
• AC-16(10)[02] authorized individuals are provided with the capability to define or change the type and value of privacy attributes available for association with subjects and objects.

Assessment Methods

Examine

• Access control policy
• procedures addressing configuration of security and privacy attributes by authorized individuals
• system design documentation
• system configuration settings and associated documentation
• system audit records
• system security plan
• privacy plan
• other relevant documents or records

Interview

• Organizational personnel with responsibilities for defining or changing security and privacy attributes associated with information
• organizational personnel with information security and privacy responsibilities
• system developers

Test

• Mechanisms implementing capability for defining or changing security and privacy attributes

Assessment Objective

Determine if:

• AC-17a.
  • AC-17a.[01] usage restrictions are established and documented for each type of remote access allowed;
  • AC-17a.[02] configuration/connection requirements are established and documented for each type of remote access allowed;
  • AC-17a.[03] implementation guidance is established and documented for each type of remote access allowed;
• AC-17b. each type of remote access to the system is authorized prior to allowing such connections.

Assessment Methods

Examine

• Access control policy
• procedures addressing remote access implementation and usage (including restrictions)
• configuration management plan
• system configuration settings and associated documentation
• remote access authorizations
• system audit records
• system security plan
• other relevant documents or records

Interview

• Organizational personnel with responsibilities for managing remote access connections
• system/network administrators
• organizational personnel with information security responsibilities

Test

• Remote access management capability for the system

Assessment Objective

Determine if:

• AC-17(01)[01] automated mechanisms are employed to monitor remote access methods;
• AC-17(01)[02] automated mechanisms are employed to control remote access methods.

Assessment Methods

Examine

• Access control policy
• procedures addressing remote access to the system
• system design documentation
• system configuration settings and associated documentation
• system audit records
• system monitoring records
• system security plan
• other relevant documents or records

Interview

• System/network administrators
• organizational personnel with information security responsibilities
• system developers

Test

• Automated mechanisms monitoring and controlling remote access methods

Assessment Objective

Determine if:

• AC-17(02) cryptographic mechanisms are implemented to protect the confidentiality and integrity of remote access sessions.

Assessment Methods

Examine

• Access control policy
• procedures addressing remote access to the system
• system design documentation
• system configuration settings and associated documentation
• cryptographic mechanisms and associated configuration documentation
• system audit records
• system security plan
• other relevant documents or records

Interview

• System/network administrators
• organizational personnel with information security responsibilities
• system developers

Test

• Cryptographic mechanisms protecting confidentiality and integrity of remote access sessions

Assessment Objective

Determine if:

• AC-17(03) remote accesses are routed through authorized and managed network access control points.

Assessment Methods

Examine

• Access control policy
• procedures addressing remote access to the system
• system design documentation
• list of all managed network access control points
• system configuration settings and associated documentation
• system audit records
• system security plan
• other relevant documents or records

Interview

• System/network administrators
• organizational personnel with information security responsibilities

Test

• Mechanisms routing all remote accesses through managed network access control points

Assessment Objective

Determine if:

• AC-17(04)(a)
  • AC-17(04)(a)[01] the execution of privileged commands via remote access is authorized only in a format that provides assessable evidence;
  • AC-17(04)(a)[02] access to security-relevant information via remote access is authorized only in a format that provides assessable evidence;
  • AC-17(04)(a)[03] the execution of privileged commands via remote access is authorized only for the following needs: [Assignment: needs requiring remote access];
  • AC-17(04)(a)[04] access to security-relevant information via remote access is authorized only for the following needs: [Assignment: needs requiring remote access];
• AC-17(04)(b) the rationale for remote access is documented in the security plan for the system.

Assessment Methods

Examine

• Access control policy
• procedures addressing remote access to the system
• system configuration settings and associated documentation
• security plan
• system audit records
• system security plan
• other relevant documents or records

Interview

• System/network administrators
• organizational personnel with information security responsibilities

Test

• Mechanisms implementing remote access management

Assessment Objective

Determine if:

• AC-17(06) information about remote access mechanisms is protected from unauthorized use and disclosure.

Assessment Methods

Examine

• Access control policy
• procedures addressing remote access to the system
• system security plan
• other relevant documents or records

Interview

• Organizational personnel with responsibilities for implementing or monitoring remote access to the system
• system users with knowledge of information about remote access mechanisms
• organizational personnel with information security responsibilities

Assessment Objective

Determine if:

• AC-17(09) the capability to disconnect or disable remote access to the system within [Assignment: time period] is provided.

Assessment Methods

Examine

• Access control policy
• procedures addressing disconnecting or disabling remote access to the system
• system design documentation
• system configuration settings and associated documentation
• security plan, system audit records
• system security plan
• other relevant documents or records

Interview

• System/network administrators
• organizational personnel with information security responsibilities
• system developers

Test

• Mechanisms implementing capability to disconnect or disable remote access to system

Assessment Objective

Determine if:

• AC-17(10) [Assignment: mechanisms] are implemented to authenticate [Assignment: remote commands].

Assessment Methods

Examine

• Access control policy
• procedures addressing authentication of remote commands
• system design documentation
• system configuration settings and associated documentation
• system audit records
• system security plan
• other relevant documents or records

Interview

• System/network administrators
• organizational personnel with information security responsibilities
• system developers

Test

• Mechanisms implementing authentication of remote commands

Assessment Objective

Determine if:

• AC-18a.
  • AC-18a.[01] configuration requirements are established for each type of wireless access;
  • AC-18a.[02] connection requirements are established for each type of wireless access;
  • AC-18a.[03] implementation guidance is established for each type of wireless access;
• AC-18b. each type of wireless access to the system is authorized prior to allowing such connections.

Assessment Methods

Examine

• Access control policy
• procedures addressing wireless access implementation and usage (including restrictions)
• configuration management plan
• system design documentation
• system configuration settings and associated documentation
• wireless access authorizations
• system audit records
• system security plan
• other relevant documents or records

Interview

• Organizational personnel with responsibilities for managing wireless access connections
• organizational personnel with information security responsibilities

Test

• Wireless access management capability for the system

Assessment Objective

Determine if:

• AC-18(01)[01] wireless access to the system is protected using authentication of [Selection (one or more): users; devices];
• AC-18(01)[02] wireless access to the system is protected using encryption.

Assessment Methods

Examine

• Access control policy
• procedures addressing wireless implementation and usage (including restrictions)
• system design documentation
• system configuration settings and associated documentation
• system audit records
• system security plan
• other relevant documents or records

Interview

• System/network administrators
• organizational personnel with information security responsibilities
• system developers

Test

• Mechanisms implementing wireless access protections to the system

Assessment Objective

Determine if:

• AC-18(03) when not intended for use, wireless networking capabilities embedded within system components are disabled prior to issuance and deployment.

Assessment Methods

Examine

• Access control policy
• procedures addressing wireless implementation and usage (including restrictions)
• system design documentation
• system configuration settings and associated documentation
• system audit records
• system security plan
• other relevant documents or records

Interview

• System/network administrators
• organizational personnel with information security responsibilities

Test

• Mechanisms managing the disabling of wireless networking capabilities internally embedded within system components

Assessment Objective

Determine if:

• AC-18(04)[01] users allowed to independently configure wireless networking capabilities are identified;
• AC-18(04)[02] users allowed to independently configure wireless networking capabilities are explicitly authorized.

Assessment Methods

Examine

• Access control policy
• procedures addressing wireless implementation and usage (including restrictions)
• system design documentation
• system configuration settings and associated documentation
• system audit records
• system security plan
• other relevant documents or records

Interview

• System/network administrators
• organizational personnel with information security responsibilities

Test

• Mechanisms authorizing independent user configuration of wireless networking capabilities

Assessment Objective

Determine if:

• AC-18(05)[01] radio antennas are selected to reduce the probability that signals from wireless access points can be received outside of organization-controlled boundaries;
• AC-18(05)[02] transmission power levels are calibrated to reduce the probability that signals from wireless access points can be received outside of organization-controlled boundaries.

Assessment Methods

Examine

• Access control policy
• procedures addressing wireless implementation and usage (including restrictions)
• system design documentation
• system configuration settings and associated documentation
• system audit records
• system security plan
• other relevant documents or records

Interview

• System/network administrators
• organizational personnel with information security responsibilities

Test

• Calibration of transmission power levels for wireless access
• radio antenna signals for wireless access
• wireless access reception outside of organization-controlled boundaries

Assessment Objective

Determine if:

• AC-19a.
  • AC-19a.[01] configuration requirements are established for organization-controlled mobile devices, including when such devices are outside of the controlled area;
  • AC-19a.[02] connection requirements are established for organization-controlled mobile devices, including when such devices are outside of the controlled area;
  • AC-19a.[03] implementation guidance is established for organization-controlled mobile devices, including when such devices are outside of the controlled area;
• AC-19b. the connection of mobile devices to organizational systems is authorized.

Assessment Methods

Examine

• Access control policy
• procedures addressing access control for mobile device usage (including restrictions)
• configuration management plan
• system design documentation
• system configuration settings and associated documentation
• authorizations for mobile device connections to organizational systems
• system audit records
• system security plan
• other relevant documents or records

Interview

• Organizational personnel using mobile devices to access organizational systems
• system/network administrators
• organizational personnel with information security responsibilities

Test

• Access control capability for mobile device connections to organizational systems
• configurations of mobile devices

Assessment Objective

Determine if:

• AC-19(04)(a) the use of unclassified mobile devices in facilities containing systems processing, storing, or transmitting classified information is prohibited unless specifically permitted by the authorizing official;
• AC-19(04)(b)
  • AC-19(04)(b)(01) prohibition of the connection of unclassified mobile devices to classified systems is enforced on individuals permitted by an authorizing official to use unclassified mobile devices in facilities containing systems processing, storing, or transmitting classified information;
  • AC-19(04)(b)(02) approval by the authorizing official for the connection of unclassified mobile devices to unclassified systems is enforced on individuals permitted to use unclassified mobile devices in facilities containing systems processing, storing, or transmitting classified information;
  • AC-19(04)(b)(03) prohibition of the use of internal or external modems or wireless interfaces within unclassified mobile devices is enforced on individuals permitted by an authorizing official to use unclassified mobile devices in facilities containing systems processing, storing, or transmitting classified information;
  • AC-19(04)(b)(04)
    • AC-19(04)(b)(04)[01] random review and inspection of unclassified mobile devices and the information stored on those devices by [Assignment: security officials] are enforced;
    • AC-19(04)(b)(04)[02] following of the incident handling policy is enforced if classified information is found during a random review and inspection of unclassified mobile devices;
• AC-19(04)(c) the connection of classified mobile devices to classified systems is restricted in accordance with [Assignment: security policies].

Assessment Methods

Examine

• Access control policy
• incident handling policy
• procedures addressing access control for mobile devices
• system design documentation
• system configuration settings and associated documentation
• evidentiary documentation for random inspections and reviews of mobile devices
• system audit records
• system security plan
• other relevant documents or records

Interview

• Organizational personnel responsible for random reviews/inspections of mobile devices
• organizational personnel using mobile devices in facilities containing systems processing, storing, or transmitting classified information
• organizational personnel with incident response responsibilities
• system/network administrators
• organizational personnel with information security responsibilities

Test

• Mechanisms prohibiting the use of internal or external modems or wireless interfaces with mobile devices

Assessment Objective

Determine if:

• AC-19(05) [Selection: full-device encryption; container-based encryption] is employed to protect the confidentiality and integrity of information on [Assignment: mobile devices].

Assessment Methods

Examine

• Access control policy
• procedures addressing access control for mobile devices
• system design documentation
• system configuration settings and associated documentation
• encryption mechanisms and associated configuration documentation
• system audit records
• system security plan
• other relevant documents or records

Interview

• Organizational personnel with access control responsibilities for mobile devices
• system/network administrators
• organizational personnel with information security responsibilities

Test

• Encryption mechanisms protecting confidentiality and integrity of information on mobile devices

Assessment Objective

Determine if:

• AC-20a.
  • AC-20a.01 [Selection (one or more): establish [Assignment: terms and conditions] ; identify [Assignment: controls asserted] ] is/are consistent with the trust relationships established with other organizations owning, operating, and/or maintaining external systems, allowing authorized individuals to access the system from external systems (if applicable);
  • AC-20a.02 [Selection (one or more): establish [Assignment: terms and conditions] ; identify [Assignment: controls asserted] ] is/are consistent with the trust relationships established with other organizations owning, operating, and/or maintaining external systems, allowing authorized individuals to process, store, or transmit organization-controlled information using external systems (if applicable);
• AC-20b. the use of [Assignment: prohibited types of external systems] is prohibited (if applicable).

Assessment Methods

Examine

• Access control policy
• procedures addressing the use of external systems
• external systems terms and conditions
• list of types of applications accessible from external systems
• maximum security categorization for information processed, stored, or transmitted on external systems
• system configuration settings and associated documentation
• system security plan
• other relevant documents or records

Interview

• Organizational personnel with responsibilities for defining terms and conditions for use of external systems to access organizational systems
• system/network administrators
• organizational personnel with information security responsibilities

Test

• Mechanisms implementing terms and conditions on the use of external systems

Assessment Objective

Determine if:

• AC-20(01)(a) authorized individuals are permitted to use an external system to access the system or to process, store, or transmit organization-controlled information only after verification of the implementation of controls on the external system as specified in the organization’s security and privacy policies and security and privacy plans (if applicable);
• AC-20(01)(b) authorized individuals are permitted to use an external system to access the system or to process, store, or transmit organization-controlled information only after retention of approved system connection or processing agreements with the organizational entity hosting the external system (if applicable).

Assessment Methods

Examine

• Access control policy
• procedures addressing the use of external systems
• system connection or processing agreements
• account management documents
• system security plan
• other relevant documents or records

Interview

• System/network administrators
• organizational personnel with information security responsibilities

Test

• Mechanisms implementing limits on use of external systems

Assessment Objective

Determine if:

• AC-20(02) the use of organization-controlled portable storage devices by authorized individuals is restricted on external systems using [Assignment: restrictions].

Assessment Methods

Examine

• Access control policy
• procedures addressing the use of external systems
• system configuration settings and associated documentation
• system connection or processing agreements
• account management documents
• system security plan
• other relevant documents or records

Interview

• Organizational personnel with responsibilities for restricting or prohibiting the use of organization-controlled storage devices on external systems
• system/network administrators
• organizational personnel with information security responsibilities

Test

• Mechanisms implementing restrictions on the use of portable storage devices

Assessment Objective

Determine if:

• AC-20(03) the use of non-organizationally owned systems or system components to process, store, or transmit organizational information is restricted using [Assignment: restrictions].

Assessment Methods

Examine

• Access control policy
• procedures addressing the use of external systems
• system design documentation
• system configuration settings and associated documentation
• system connection or processing agreements
• account management documents
• system audit records, other relevant documents or records

Interview

• Organizational personnel with responsibilities for restricting or prohibiting the use of non-organizationally owned systems, system components, or devices
• system/network administrators
• organizational personnel with information security responsibilities

Test

• Mechanisms implementing restrictions on the use of non-organizationally owned systems, components, or devices

Assessment Objective

Determine if:

• AC-20(04) the use of [Assignment: network-accessible storage devices] is prohibited in external systems.

Assessment Methods

Examine

• Access control policy
• procedures addressing use of network-accessible storage devices in external systems
• system design documentation
• system configuration settings and associated documentation
• system connection or processing agreements
• list of network-accessible storage devices prohibited from use in external systems
• system audit records
• system security plan
• other relevant documents or records

Interview

• Organizational personnel with responsibilities for prohibiting the use of network-accessible storage devices in external systems
• system/network administrators
• organizational personnel with information security responsibilities

Test

• Mechanisms prohibiting the use of network-accessible storage devices in external systems

Assessment Objective

Determine if:

• AC-20(05) the use of organization-controlled portable storage devices by authorized individuals is prohibited on external systems.

Assessment Methods

Examine

• Access control policy
• procedures addressing use of portable storage devices in external systems
• system design documentation
• system configuration settings and associated documentation
• system connection or processing agreements
• system audit records
• system security plan
• other relevant documents or records

Interview

• Organizational personnel with responsibilities for prohibiting the use of portable storage devices in external systems
• system/network administrators
• organizational personnel with information security responsibilities

Assessment Objective

Determine if:

• AC-21a. authorized users are enabled to determine whether access authorizations assigned to a sharing partner match the information’s access and use restrictions for [Assignment: information-sharing circumstances];
• AC-21b. [Assignment: automated mechanisms] are employed to assist users in making information-sharing and collaboration decisions.

Assessment Methods

Examine

• Access control policy
• procedures addressing user-based collaboration and information sharing (including restrictions)
• system design documentation
• system configuration settings and associated documentation
• list of users authorized to make information-sharing/collaboration decisions
• list of information-sharing circumstances requiring user discretion
• non-disclosure agreements
• acquisitions/contractual agreements
• system security plan
• privacy plan
• privacy impact assessment
• security and privacy risk assessments
• other relevant documents or records

Interview

• Organizational personnel responsible for information-sharing/collaboration decisions
• organizational personnel with responsibility for acquisitions/contractual agreements
• system/network administrators
• organizational personnel with information security and privacy responsibilities

Test

• Automated mechanisms or manual process implementing access authorizations supporting information-sharing/user collaboration decisions

Assessment Objective

Determine if:

• AC-21(01) [Assignment: automated mechanisms] are employed to enforce information-sharing decisions by authorized users based on access authorizations of sharing partners and access restrictions on information to be shared.

Assessment Methods

Examine

• Access control policy
• procedures addressing user-based collaboration and information sharing (including restrictions)
• system design documentation
• system configuration settings and associated documentation
• system-generated list of users authorized to make information-sharing/collaboration decisions
• system-generated list of sharing partners and access authorizations
• system-generated list of access restrictions regarding information to be shared
• system security plan
• other relevant documents or records

Interview

• System/network administrators
• organizational personnel with information security responsibilities
• system developers

Test

• Automated mechanisms implementing access authorizations supporting information-sharing/user collaboration decisions

Assessment Objective

Determine if:

• AC-21(02) information search and retrieval services that enforce [Assignment: information-sharing restrictions] are implemented.

Assessment Methods

Examine

• Access control policy
• procedures addressing user-based collaboration and information sharing (including restrictions)
• system design documentation
• system configuration settings and associated documentation
• system-generated list of access restrictions regarding information to be shared
• information search and retrieval records
• system audit records
• system security plan
• other relevant documents or records

Interview

• Organizational personnel with access enforcement responsibilities for system search and retrieval services
• system/network administrators
• organizational personnel with information security responsibilities
• system developers

Test

• System search and retrieval services enforcing information-sharing restrictions

Assessment Objective

Determine if:

• AC-22a. designated individuals are authorized to make information publicly accessible;
• AC-22b. authorized individuals are trained to ensure that publicly accessible information does not contain non-public information;
• AC-22c. the proposed content of information is reviewed prior to posting onto the publicly accessible system to ensure that non-public information is not included;
• AC-22d.
  • AC-22d.[01] the content on the publicly accessible system is reviewed for non-public information [Assignment: frequency];
  • AC-22d.[02] non-public information is removed from the publicly accessible system, if discovered.

Assessment Methods

Examine

• Access control policy
• procedures addressing publicly accessible content
• list of users authorized to post publicly accessible content on organizational systems
• training materials and/or records
• records of publicly accessible information reviews
• records of response to non-public information on public websites
• system audit logs
• security awareness training records
• system security plan
• other relevant documents or records

Interview

• Organizational personnel with responsibilities for managing publicly accessible information posted on organizational systems
• organizational personnel with information security responsibilities

Test

• Mechanisms implementing management of publicly accessible content

Assessment Objective

Determine if:

• AC-23 [Assignment: techniques] are employed for [Assignment: data storage objects] to detect and protect against unauthorized data mining.

Assessment Methods

Examine

• Access control policy
• procedures for preventing and detecting data mining
• policies and procedures addressing authorized data mining techniques
• procedures addressing protection of data storage objects against data mining
• system design documentation
• system configuration settings and associated documentation
• system audit logs
• system audit records
• procedures addressing differential privacy techniques
• notifications of atypical database queries or accesses
• documentation or reports of insider threat program
• system security plan
• privacy plan
• other relevant documents or records

Interview

• Organizational personnel with responsibilities for implementing data mining detection and prevention techniques for data storage objects
• legal counsel
• organizational personnel with information security and privacy responsibilities
• system developers

Test

• Mechanisms implementing data mining prevention and detection

Assessment Objective

Determine if:

• AC-24 [Selection (one or more): establish procedures; implement mechanisms] are taken to ensure that [Assignment: access control decisions] are applied to each access request prior to access enforcement.

Assessment Methods

Examine

• Access control policy
• procedures addressing access control decisions
• system design documentation
• system configuration settings and associated documentation
• system audit records
• system security plan
• other relevant documents or records

Interview

• Organizational personnel with responsibilities for establishing procedures regarding access control decisions to the system
• organizational personnel with information security responsibilities

Test

• Mechanisms applying established access control decisions and procedures

Assessment Objective

Determine if:

• AC-24(01) [Assignment: access authorization information] is transmitted using [Assignment: controls] to [Assignment: systems] that enforce access control decisions.

Assessment Methods

Examine

• Access control policy
• procedures addressing access enforcement
• system design documentation
• system configuration settings and associated documentation
• system audit records
• system security plan
• other relevant documents or records

Interview

• Organizational personnel with access enforcement responsibilities
• system/network administrators
• organizational personnel with information security responsibilities
• system developers

Test

• Mechanisms implementing access enforcement functions

Assessment Objective

Determine if:

• AC-24(02)[01] access control decisions are enforced based on [Assignment: security attributes] that do not include the identity of the user or process acting on behalf of the user (if selected);
• AC-24(02)[02] access control decisions are enforced based on [Assignment: privacy attributes] that do not include the identity of the user or process acting on behalf of the user (if selected).

Assessment Methods

Examine

• Access control policy
• procedures addressing access enforcement
• system design documentation
• system configuration settings and associated documentation
• system audit records
• system security plan
• privacy plan
• other relevant documents or records

Interview

• Organizational personnel with access enforcement responsibilities
• system/network administrators
• organizational personnel with information security and privacy responsibilities
• system developers

Test

• Mechanisms implementing access enforcement functions

Assessment Objective

Determine if:

• AC-25 a reference monitor is implemented for [Assignment: access control policies] that is tamper-proof, always invoked, and small enough to be subject to analysis and testing, the completeness of which can be assured.

Assessment Methods

Examine

• Access control policy
• procedures addressing access enforcement
• system design documentation
• system configuration settings and associated documentation
• system audit records
• system security plan
• other relevant documents or records

Interview

• Organizational personnel with access enforcement responsibilities
• system/network administrators
• organizational personnel with information security responsibilities
• system developers

Test

• Mechanisms implementing access enforcement functions

Assessment Objective

Determine if:

• AT-01a.
  • AT-01a.[01] an awareness and training policy is developed and documented;
  • AT-01a.[02] the awareness and training policy is disseminated to [Assignment: personnel or roles];
  • AT-01a.[03] awareness and training procedures to facilitate the implementation of the awareness and training policy and associated access controls are developed and documented;
  • AT-01a.[04] the awareness and training procedures are disseminated to [Assignment: personnel or roles].
  • AT-01a.01
    • AT-01a.01(a)
      • AT-01a.01(a)[01] the [Selection (one or more): organization-level; mission/business process-level; system-level] awareness and training policy addresses purpose;
      • AT-01a.01(a)[02] the [Selection (one or more): organization-level; mission/business process-level; system-level] awareness and training policy addresses scope;
      • AT-01a.01(a)[03] the [Selection (one or more): organization-level; mission/business process-level; system-level] awareness and training policy addresses roles;
      • AT-01a.01(a)[04] the [Selection (one or more): organization-level; mission/business process-level; system-level] awareness and training policy addresses responsibilities;
      • AT-01a.01(a)[05] the [Selection (one or more): organization-level; mission/business process-level; system-level] awareness and training policy addresses management commitment;
      • AT-01a.01(a)[06] the [Selection (one or more): organization-level; mission/business process-level; system-level] awareness and training policy addresses coordination among organizational entities;
      • AT-01a.01(a)[07] the [Selection (one or more): organization-level; mission/business process-level; system-level] awareness and training policy addresses compliance; and
    • AT-01a.01(b) the [Selection (one or more): organization-level; mission/business process-level; system-level] awareness and training policy is consistent with applicable laws, Executive Orders, directives, regulations, policies, standards, and guidelines; and
• AT-01b. the [Assignment: official] is designated to manage the development, documentation, and dissemination of the awareness and training policy and procedures;
• AT-01c.
  • AT-01c.01
    • AT-01c.01[01] the current awareness and training policy is reviewed and updated [Assignment: frequency];
    • AT-01c.01[02] the current awareness and training policy is reviewed and updated following [Assignment: events];
  • AT-01c.02
    • AT-01c.02[01] the current awareness and training procedures are reviewed and updated [Assignment: frequency];
    • AT-01c.02[02] the current awareness and training procedures are reviewed and updated following [Assignment: events].

Assessment Methods

Examine

• System security plan
• privacy plan
• awareness and training policy and procedures
• other relevant documents or records

Interview

• Organizational personnel with awareness and training responsibilities
• organizational personnel with information security and privacy responsibilities

Assessment Objective

Determine if:

• AT-02a.
  • AT-02a.01
    • AT-02a.01[01] security literacy training is provided to system users (including managers, senior executives, and contractors) as part of initial training for new users;
    • AT-02a.01[02] privacy literacy training is provided to system users (including managers, senior executives, and contractors) as part of initial training for new users;
    • AT-02a.01[03] security literacy training is provided to system users (including managers, senior executives, and contractors) [Assignment: frequency] thereafter;
    • AT-02a.01[04] privacy literacy training is provided to system users (including managers, senior executives, and contractors) [Assignment: frequency] thereafter;
  • AT-02a.02
    • AT-02a.02[01] security literacy training is provided to system users (including managers, senior executives, and contractors) when required by system changes or following [Assignment: events];
    • AT-02a.02[02] privacy literacy training is provided to system users (including managers, senior executives, and contractors) when required by system changes or following [Assignment: events];
• AT-02b. [Assignment: awareness techniques] are employed to increase the security and privacy awareness of system users;
• AT-02c.
  • AT-02c.[01] literacy training and awareness content is updated [Assignment: frequency];
  • AT-02c.[02] literacy training and awareness content is updated following [Assignment: events];
• AT-02d. lessons learned from internal or external security incidents or breaches are incorporated into literacy training and awareness techniques.

Assessment Methods

Examine

• System security plan
• privacy plan
• literacy training and awareness policy
• procedures addressing literacy training and awareness implementation
• appropriate codes of federal regulations
• security and privacy literacy training curriculum
• security and privacy literacy training materials
• training records
• other relevant documents or records

Interview

• Organizational personnel with responsibilities for literacy training and awareness
• organizational personnel with information security and privacy responsibilities
• organizational personnel comprising the general system user community

Test

• Mechanisms managing information security and privacy literacy training

Assessment Objective

Determine if:

• AT-02(01) practical exercises in literacy training that simulate events and incidents are provided.

Assessment Methods

Examine

• System security plan
• privacy plan
• security awareness and training policy
• procedures addressing security awareness training implementation
• security awareness training curriculum
• security awareness training materials
• other relevant documents or records

Interview

• Organizational personnel who receive literacy training and awareness
• organizational personnel with responsibilities for security awareness training
• organizational personnel with information security responsibilities

Test

• Mechanisms implementing cyber-attack simulations in practical exercises

Assessment Objective

Determine if:

• AT-02(02)[01] literacy training on recognizing potential indicators of insider threat is provided;
• AT-02(02)[02] literacy training on reporting potential indicators of insider threat is provided.

Assessment Methods

Examine

• System security plan
• privacy plan
• literacy training and awareness policy
• procedures addressing literacy training and awareness implementation
• literacy training and awareness curriculum
• literacy training and awareness materials
• other relevant documents or records

Interview

• Organizational personnel who receive literacy training and awareness
• organizational personnel with responsibilities for literacy training and awareness
• organizational personnel with information security and privacy responsibilities

Assessment Objective

Determine if:

• AT-02(03)[01] literacy training on recognizing potential and actual instances of social engineering is provided;
• AT-02(03)[02] literacy training on reporting potential and actual instances of social engineering is provided;
• AT-02(03)[03] literacy training on recognizing potential and actual instances of social mining is provided;
• AT-02(03)[04] literacy training on reporting potential and actual instances of social mining is provided.

Assessment Methods

Examine

• System security plan
• privacy plan
• literacy training and awareness policy
• procedures addressing literacy training and awareness implementation
• literacy training and awareness curriculum
• literacy training and awareness materials
• other relevant documents or records

Interview

• Organizational personnel who receive literacy training and awareness
• organizational personnel with responsibilities for literacy training and awareness
• organizational personnel with information security and privacy responsibilities

Assessment Objective

Determine if:

• AT-02(04) literacy training on recognizing suspicious communications and anomalous behavior in organizational systems using [Assignment: indicators of malicious code] is provided.

Assessment Methods

Examine

• System security plan
• privacy plan
• literacy training and awareness policy
• procedures addressing literacy training and awareness implementation
• literacy training and awareness curriculum
• literacy training and awareness materials
• other relevant documents or records

Interview

• Organizational personnel who receive literacy training and awareness
• organizational personnel with responsibilities for basic literacy training and awareness
• organizational personnel with information security and privacy responsibilities

Assessment Objective

Determine if:

• AT-02(05) literacy training on the advanced persistent threat is provided.

Assessment Methods

Examine

• System security plan
• privacy plan
• literacy training and awareness policy
• procedures addressing literacy training and awareness implementation
• literacy training and awareness curriculum
• literacy training and awareness materials
• other relevant documents or records

Interview

• Organizational personnel who receive literacy training and awareness
• organizational personnel with responsibilities for basic literacy training and awareness
• organizational personnel with information security and privacy responsibilities

Assessment Objective

Determine if:

• AT-02(06)(a) literacy training on the cyber threat environment is provided;
• AT-02(06)(b) system operations reflects current cyber threat information.

Assessment Methods

Examine

• System security plan
• privacy plan
• literacy training and awareness policy
• procedures addressing literacy training and awareness training implementation
• literacy training and awareness curriculum
• literacy training and awareness materials
• other relevant documents or records

Interview

• Organizational personnel who receive literacy training and awareness
• organizational personnel with responsibilities for basic literacy training and awareness
• organizational personnel with information security and privacy responsibilities

Assessment Objective

Determine if:

• AT-03a.
  • AT-03a.01
    • AT-03a.01[01] role-based security training is provided to [Assignment: roles and responsibilities] before authorizing access to the system, information, or performing assigned duties;
    • AT-03a.01[02] role-based privacy training is provided to [Assignment: roles and responsibilities] before authorizing access to the system, information, or performing assigned duties;
    • AT-03a.01[03] role-based security training is provided to [Assignment: roles and responsibilities] [Assignment: frequency] thereafter;
    • AT-03a.01[04] role-based privacy training is provided to [Assignment: roles and responsibilities] [Assignment: frequency] thereafter;
  • AT-03a.02
    • AT-03a.02[01] role-based security training is provided to personnel with assigned security roles and responsibilities when required by system changes;
    • AT-03a.02[02] role-based privacy training is provided to personnel with assigned security roles and responsibilities when required by system changes;
• AT-03b.
  • AT-03b.[01] role-based training content is updated [Assignment: frequency];
  • AT-03b.[02] role-based training content is updated following [Assignment: events];
• AT-03c. lessons learned from internal or external security incidents or breaches are incorporated into role-based training.

Assessment Methods

Examine

• System security plan
• privacy plan
• security and privacy awareness and training policy
• procedures addressing security and privacy training implementation
• codes of federal regulations
• security and privacy training curriculum
• security and privacy training materials
• training records
• other relevant documents or records

Interview

• Organizational personnel with responsibilities for role-based security and privacy training
• organizational personnel with assigned system security and privacy roles and responsibilities

Test

• Mechanisms managing role-based security and privacy training

Assessment Objective

Determine if:

• AT-03(01) [Assignment: personnel or roles] are provided with initial and refresher training [Assignment: frequency] in the employment and operation of environmental controls.

Assessment Methods

Examine

• Security and privacy awareness and training policy
• procedures addressing security and privacy training implementation
• security and privacy training curriculum
• security and privacy training materials
• system security plan
• privacy plan
• training records
• other relevant documents or records

Interview

• Organizational personnel with responsibilities for role-based security and privacy training
• organizational personnel with responsibilities for employing and operating environmental controls

Assessment Objective

Determine if:

• AT-03(02) [Assignment: personnel or roles] is/are provided with initial and refresher training [Assignment: frequency] in the employment and operation of physical security controls.

Assessment Methods

Examine

• Security and privacy awareness and training policy
• procedures addressing security and privacy training implementation
• security and privacy training curriculum
• security and privacy training materials
• system security plan
• privacy plan
• training records
• other relevant documents or records

Interview

• Organizational personnel with responsibilities for role-based security and privacy training
• organizational personnel with responsibilities for employing and operating physical security controls

Assessment Objective

Determine if:

• AT-03(03)[01] practical exercises in security training that reinforce training objectives are provided;
• AT-03(03)[02] practical exercises in privacy training that reinforce training objectives are provided.

Assessment Methods

Examine

• Security and privacy awareness and training policy
• procedures addressing security and privacy awareness training implementation
• security and privacy awareness training curriculum
• security and privacy awareness training materials
• security and privacy awareness training reports and results
• system security plan
• privacy plan
• other relevant documents or records

Interview

• Organizational personnel with responsibilities for role-based security and privacy training
• organizational personnel who participate in security and privacy awareness training

Assessment Objective

Determine if:

• AT-03(05) [Assignment: personnel or roles] are provided with initial and refresher training [Assignment: frequency] in the employment and operation of personally identifiable information processing and transparency controls.

Assessment Methods

Examine

• Security and privacy awareness and training policy
• procedures addressing security and privacy awareness training implementation
• security and privacy awareness training curriculum
• security and privacy awareness training materials
• system security plan
• privacy plan
• organizational privacy notices
• organizational policies
• system of records notices
• Privacy Act statements
• computer matching agreements and notices
• privacy impact assessments
• information sharing agreements
• other relevant documents or records

Interview

• Organizational personnel with responsibilities for role-based security and privacy training
• organizational personnel who participate in security and privacy awareness training

Assessment Objective

Determine if:

• AT-04a.
  • AT-04a.[01] information security and privacy training activities, including security and privacy awareness training and specific role-based security and privacy training, are documented;
  • AT-04a.[02] information security and privacy training activities, including security and privacy awareness training and specific role-based security and privacy training, are monitored;
• AT-04b. individual training records are retained for [Assignment: time period].

Assessment Methods

Examine

• Security and privacy awareness and training policy
• procedures addressing security and privacy training records
• security and privacy awareness and training records
• system security plan
• privacy plan
• other relevant documents or records

Interview

• Organizational personnel with information security and privacy training record retention responsibilities

Test

• Mechanisms supporting the management of security and privacy training records

Assessment Objective

Determine if:

• AT-06 feedback on organizational training results is provided [Assignment: frequency] to [Assignment: personnel].

Assessment Methods

Examine

• Security awareness and training policy
• procedures addressing security training records
• security awareness and training records
• security plan
• other relevant documents or records

Interview

• Organizational personnel with information security training record retention responsibilities

Test

• Mechanisms supporting the management of security training records

Assessment Objective

Determine if:

• AU-01a.
  • AU-01a.[01] an audit and accountability policy is developed and documented;
  • AU-01a.[02] the audit and accountability policy is disseminated to [Assignment: personnel or roles];
  • AU-01a.[03] audit and accountability procedures to facilitate the implementation of the audit and accountability policy and associated audit and accountability controls are developed and documented;
  • AU-01a.[04] the audit and accountability procedures are disseminated to [Assignment: personnel or roles];
  • AU-01a.01
    • AU-01a.01(a)
      • AU-01a.01(a)[01] the [Selection (one or more): organization-level; mission/business process-level; system-level] of the audit and accountability policy addresses purpose;
      • AU-01a.01(a)[02] the [Selection (one or more): organization-level; mission/business process-level; system-level] of the audit and accountability policy addresses scope;
      • AU-01a.01(a)[03] the [Selection (one or more): organization-level; mission/business process-level; system-level] of the audit and accountability policy addresses roles;
      • AU-01a.01(a)[04] the [Selection (one or more): organization-level; mission/business process-level; system-level] of the audit and accountability policy addresses responsibilities;
      • AU-01a.01(a)[05] the [Selection (one or more): organization-level; mission/business process-level; system-level] of the audit and accountability policy addresses management commitment;
      • AU-01a.01(a)[06] the [Selection (one or more): organization-level; mission/business process-level; system-level] of the audit and accountability policy addresses coordination among organizational entities;
      • AU-01a.01(a)[07] the [Selection (one or more): organization-level; mission/business process-level; system-level] of the audit and accountability policy addresses compliance;
    • AU-01a.01(b) the [Selection (one or more): organization-level; mission/business process-level; system-level] of the audit and accountability policy is consistent with applicable laws, executive orders, directives, regulations, policies, standards, and guidelines;
• AU-01b. the [Assignment: official] is designated to manage the development, documentation, and dissemination of the audit and accountability policy and procedures;
• AU-01c.
  • AU-01c.01
    • AU-01c.01[01] the current audit and accountability policy is reviewed and updated [Assignment: frequency];
    • AU-01c.01[02] the current audit and accountability policy is reviewed and updated following [Assignment: events];
  • AU-01c.02
    • AU-01c.02[01] the current audit and accountability procedures are reviewed and updated [Assignment: frequency];
    • AU-01c.02[02] the current audit and accountability procedures are reviewed and updated following [Assignment: events].

Assessment Methods

Examine

• Audit and accountability policy and procedures
• system security plan
• privacy plan
• other relevant documents or records

Interview

• Organizational personnel with audit and accountability responsibilities
• organizational personnel with information security and privacy responsibilities

Assessment Objective

Determine if:

• AU-02a. [Assignment: event types] that the system is capable of logging are identified in support of the audit logging function;
• AU-02b. the event logging function is coordinated with other organizational entities requiring audit-related information to guide and inform the selection criteria for events to be logged;
• AU-02c.
  • AU-02c.[01] [Assignment: event types (subset of AU-02_ODP[01])] are specified for logging within the system;
  • AU-02c.[02] the specified event types are logged within the system [Assignment: frequency or situation];
• AU-02d. a rationale is provided for why the event types selected for logging are deemed to be adequate to support after-the-fact investigations of incidents;
• AU-02e. the event types selected for logging are reviewed and updated [Assignment: frequency].

Assessment Methods

Examine

• Audit and accountability policy
• procedures addressing auditable events
• system security plan
• privacy plan
• system design documentation
• system configuration settings and associated documentation
• system audit records
• system auditable events
• other relevant documents or records

Interview

• Organizational personnel with audit and accountability responsibilities
• organizational personnel with information security and privacy responsibilities
• system/network administrators

Test

• Mechanisms implementing system auditing

Assessment Objective

Determine if:

• AU-03a. audit records contain information that establishes what type of event occurred;
• AU-03b. audit records contain information that establishes when the event occurred;
• AU-03c. audit records contain information that establishes where the event occurred;
• AU-03d. audit records contain information that establishes the source of the event;
• AU-03e. audit records contain information that establishes the outcome of the event;
• AU-03f. audit records contain information that establishes the identity of any individuals, subjects, or objects/entities associated with the event.

Assessment Methods

Examine

• Audit and accountability policy
• system security plan
• privacy plan
• procedures addressing content of audit records
• system design documentation
• system configuration settings and associated documentation
• list of organization-defined auditable events
• system audit records
• system incident reports
• other relevant documents or records

Interview

• Organizational personnel with audit and accountability responsibilities
• organizational personnel with information security and privacy responsibilities
• system/network administrators

Test

• Mechanisms implementing system auditing of auditable events

Assessment Objective

Determine if:

• AU-03(01) generated audit records contain the following [Assignment: additional information].

Assessment Methods

Examine

• Audit and accountability policy
• procedures addressing content of audit records
• system security plan
• privacy plan
• system design documentation
• system configuration settings and associated documentation
• list of organization-defined auditable events
• system audit records
• other relevant documents or records

Interview

• Organizational personnel with audit and accountability responsibilities
• organizational personnel with information security and privacy responsibilities
• system/network administrators
• system developers

Test

• system audit capability

Assessment Objective

Determine if:

• AU-03(03) personally identifiable information contained in audit records is limited to [Assignment: elements] identified in the privacy risk assessment.

Assessment Methods

Examine

• Audit and accountability policy
• system security plan
• privacy plan
• privacy risk assessment
• privacy risk assessment results
• procedures addressing content of audit records
• system design documentation
• system configuration settings and associated documentation
• list of organization-defined auditable events
• system audit records
• third party contracts
• other relevant documents or records

Interview

• Organizational personnel with audit and accountability responsibilities
• organizational personnel with information security and privacy responsibilities
• system/network administrators
• system developers

Test

• system audit capability

Assessment Objective

Determine if:

• AU-04 audit log storage capacity is allocated to accommodate [Assignment: audit log retention requirements].

Assessment Methods

Examine

• Audit and accountability policy
• procedures addressing audit storage capacity
• system security plan
• privacy plan
• system design documentation
• system configuration settings and associated documentation
• audit record storage requirements
• audit record storage capability for system components
• system audit records
• other relevant documents or records

Interview

• Organizational personnel with audit and accountability responsibilities
• organizational personnel with information security and privacy responsibilities
• system/network administrators
• system developers

Test

• Audit record storage capacity and related configuration settings

Assessment Objective

Determine if:

• AU-04(01) audit logs are transferred [Assignment: frequency] to a different system, system component, or media other than the system or system component conducting the logging.

Assessment Methods

Examine

• Audit and accountability policy
• system security plan
• privacy plan
• procedures addressing audit storage capacity
• procedures addressing transfer of system audit records to secondary or alternate systems
• system design documentation
• system configuration settings and associated documentation
• logs of audit record transfers to secondary or alternate systems
• system audit records transferred to secondary or alternate systems
• other relevant documents or records

Interview

• Organizational personnel with audit storage capacity planning responsibilities
• organizational personnel with information security and privacy responsibilities
• system/network administrators

Test

• Mechanisms supporting the transfer of audit records onto a different system

Assessment Objective

Determine if:

• AU-05a. [Assignment: personnel or roles] are alerted in the event of an audit logging process failure within [Assignment: time period];
• AU-05b. [Assignment: additional actions] are taken in the event of an audit logging process failure.

Assessment Methods

Examine

• Audit and accountability policy
• procedures addressing response to audit processing failures
• system design documentation
• system security plan
• privacy plan
• system configuration settings and associated documentation
• list of personnel to be notified in case of an audit processing failure
• system audit records
• other relevant documents or records

Interview

• Organizational personnel with audit and accountability responsibilities
• organizational personnel with information security and privacy responsibilities
• system/network administrators
• system developers

Test

• Mechanisms implementing system response to audit processing failures

Assessment Objective

Determine if:

• AU-05(01) a warning is provided to [Assignment: personnel, roles, and/or locations] within [Assignment: time period] when allocated audit log storage volume reaches [Assignment: percentage] of repository maximum audit log storage capacity.

Assessment Methods

Examine

• Audit and accountability policy
• procedures addressing response to audit processing failures
• system design documentation
• system security plan
• privacy system configuration settings and associated documentation
• system audit records
• other relevant documents or records

Interview

• Organizational personnel with audit and accountability responsibilities
• organizational personnel with information security and privacy responsibilities
• system/network administrators
• system developers

Test

• Mechanisms implementing audit storage limit warnings

Assessment Objective

Determine if:

• AU-05(02) an alert is provided within [Assignment: real-time period] to [Assignment: personnel, roles, and/or locations] when [Assignment: audit logging failure events requiring real-time alerts] occur.

Assessment Methods

Examine

• Audit and accountability policy
• procedures addressing response to audit processing failures
• system design documentation
• system security plan
• privacy plan
• system configuration settings and associated documentation
• system audit records
• other relevant documents or records

Interview

• Organizational personnel with audit and accountability responsibilities
• organizational personnel with information security and privacy responsibilities
• system/network administrators
• system developers

Assessment Objective

Determine if:

• AU-05(03)[01] configurable network communications traffic volume thresholds reflecting limits on audit log storage capacity are enforced;
• AU-05(03)[02] network traffic is [Selection (one or more): reject; delay] if network traffic volume is above configured thresholds.

Assessment Methods

Examine

• Audit and accountability policy
• procedures addressing response to audit processing failures
• system design documentation
• system security plan
• privacy plan
• system configuration settings and associated documentation
• system audit records
• other relevant documents or records

Interview

• Organizational personnel with audit and accountability responsibilities
• organizational personnel with information security and privacy responsibilities
• system/network administrators
• system developers

Assessment Objective

Determine if:

• AU-05(04) [Selection (one or more): full system shutdown; partial system shutdown; degraded operational mode with limited mission or business functionality available] is/are invoked in the event of [Assignment: audit logging failures] , unless an alternate audit logging capability exists.

Assessment Methods

Examine

• Audit and accountability policy
• procedures addressing response to audit processing failures
• system design documentation
• system security plan
• privacy plan
• system configuration settings and associated documentation
• system audit records
• other relevant documents or records

Interview

• Organizational personnel with audit and accountability responsibilities
• organizational personnel with information security and privacy responsibilities
• system/network administrators
• system developers

Test

• System capability invoking system shutdown or degraded operational mode in the event of an audit processing failure

Assessment Objective

Determine if:

• AU-05(05) an alternate audit logging capability is provided in the event of a failure in primary audit logging capability that implements [Assignment: alternate audit logging functionality].

Assessment Methods

Examine

• Audit and accountability policy
• procedures addressing response to audit processing failures
• system design documentation
• system security plan
• privacy plan
• system configuration settings and associated documentation
• system audit records
• other relevant documents or records

Interview

• Organizational personnel with audit and accountability responsibilities
• organizational personnel with information security and privacy responsibilities
• system/network administrators
• system developers

Test

• Alternate audit logging capability

Assessment Objective

Determine if:

• AU-06a. system audit records are reviewed and analyzed [Assignment: frequency] for indications of [Assignment: inappropriate or unusual activity] and the potential impact of the inappropriate or unusual activity;
• AU-06b. findings are reported to [Assignment: personnel or roles];
• AU-06c. the level of audit record review, analysis, and reporting within the system is adjusted when there is a change in risk based on law enforcement information, intelligence information, or other credible sources of information.

Assessment Methods

Examine

• Audit and accountability policy
• system security plan
• privacy plan
• procedures addressing audit review, analysis, and reporting
• reports of audit findings
• records of actions taken in response to reviews/analyses of audit records
• other relevant documents or records

Interview

• Organizational personnel with audit review, analysis, and reporting responsibilities
• organizational personnel with information security and privacy responsibilities

Assessment Objective

Determine if:

• AU-06(01) audit record review, analysis, and reporting processes are integrated using [Assignment: automated mechanisms].

Assessment Methods

Examine

• Audit and accountability policy
• system security plan
• privacy plan
• procedures addressing audit review, analysis, and reporting
• procedures addressing investigation and response to suspicious activities
• system design documentation
• system configuration settings and associated documentation
• system audit records
• other relevant documents or records

Interview

• Organizational personnel with audit review, analysis, and reporting responsibilities
• organizational personnel with information security and privacy responsibilities

Test

• Automated mechanisms integrating audit review, analysis, and reporting processes

Assessment Objective

Determine if:

• AU-06(03) audit records across different repositories are analyzed and correlated to gain organization-wide situational awareness.

Assessment Methods

Examine

• Audit and accountability policy
• system security plan
• privacy plan
• procedures addressing audit review, analysis, and reporting
• system design documentation
• system configuration settings and associated documentation
• system audit records across different repositories
• other relevant documents or records

Interview

• Organizational personnel with audit review, analysis, and reporting responsibilities
• organizational personnel with information security and privacy responsibilities

Test

• Mechanisms supporting the analysis and correlation of audit records

Assessment Objective

Determine if:

• AU-06(04)[01] the capability to centrally review and analyze audit records from multiple components within the system is provided;
• AU-06(04)[02] the capability to centrally review and analyze audit records from multiple components within the system is implemented.

Assessment Methods

Examine

• Audit and accountability policy
• procedures addressing audit review, analysis, and reporting
• system design documentation
• system configuration settings and associated documentation
• system security plan
• privacy plan
• system audit records
• other relevant documents or records

Interview

• Organizational personnel with audit review, analysis, and reporting responsibilities
• organizational personnel with information security and privacy responsibilities
• system developers

Test

• System capability to centralize review and analysis of audit records

Assessment Objective

Determine if:

• AU-06(05) analysis of audit records is integrated with analysis of [Selection (one or more): vulnerability scanning information; performance data; system monitoring information; [Assignment: data/information collected from other sources] ] to further enhance the ability to identify inappropriate or unusual activity.

Assessment Methods

Examine

• Audit and accountability policy
• system security plan
• privacy plan
• procedures addressing audit review, analysis, and reporting
• system design documentation
• system configuration settings and associated documentation
• integrated analysis of audit records, vulnerability scanning information, performance data, network monitoring information, and associated documentation
• other relevant documents or records

Interview

• Organizational personnel with audit review, analysis, and reporting responsibilities
• organizational personnel with information security and privacy responsibilities

Test

• Mechanisms implementing the capability to integrate analysis of audit records with analysis of data/information sources

Assessment Objective

Determine if:

• AU-06(06) information from audit records is correlated with information obtained from monitoring physical access to further enhance the ability to identify suspicious, inappropriate, unusual, or malevolent activity.

Assessment Methods

Examine

• Audit and accountability policy
• procedures addressing audit review, analysis, and reporting
• procedures addressing physical access monitoring
• system design documentation
• system configuration settings and associated documentation
• documentation providing evidence of correlated information obtained from audit records and physical access monitoring records
• system security plan
• privacy plan
• other relevant documents or records

Interview

• Organizational personnel with audit review, analysis, and reporting responsibilities
• organizational personnel with physical access monitoring responsibilities
• organizational personnel with information security and privacy responsibilities

Test

• Mechanisms implementing the capability to correlate information from audit records with information from monitoring physical access

Assessment Objective

Determine if:

• AU-06(07) the permitted actions for each [Selection (one or more): system process; role; user] associated with the review, analysis, and reporting of audit record information are specified.

Assessment Methods

Examine

• Audit and accountability policy
• procedures addressing process, role and/or user permitted actions from audit review, analysis, and reporting
• system security plan
• privacy plan
• other relevant documents or records

Interview

• Organizational personnel with audit review, analysis, and reporting responsibilities
• organizational personnel with information security and privacy responsibilities

Test

• Mechanisms supporting permitted actions for the review, analysis, and reporting of audit information

Assessment Objective

Determine if:

• AU-06(08) a full text analysis of logged privileged commands in a physically distinct component or subsystem of the system or other system that is dedicated to that analysis is performed.

Assessment Methods

Examine

• Audit and accountability policy
• procedures addressing audit review, analysis, and reporting
• system design documentation
• system configuration settings and associated documentation
• text analysis tools and techniques
• text analysis documentation of audited privileged commands
• system security plan
• privacy plan
• other relevant documents or records

Interview

• Organizational personnel with audit review, analysis, and reporting responsibilities
• organizational personnel with information security and privacy responsibilities

Test

• Mechanisms implementing the capability to perform a full text analysis of audited privilege commands

Assessment Objective

Determine if:

• AU-06(09) information from non-technical sources is correlated with audit record information to enhance organization-wide situational awareness.

Assessment Methods

Examine

• Audit and accountability policy
• system security plan
• privacy plan
• procedures addressing audit review, analysis, and reporting
• system design documentation
• system configuration settings and associated documentation
• documentation providing evidence of correlated information obtained from audit records and organization-defined non-technical sources
• list of information types from non-technical sources for correlation with audit information
• other relevant documents or records

Interview

• Organizational personnel with audit review, analysis, and reporting responsibilities
• organizational personnel with information security and privacy responsibilities

Test

• Mechanisms implementing capability to correlate information from non-technical sources

Assessment Objective

Determine if:

• AU-07a.
  • AU-07a.[01] an audit record reduction and report generation capability is provided that supports on-demand audit record review, analysis, and reporting requirements and after-the-fact investigations of incidents;
  • AU-07a.[02] an audit record reduction and report generation capability is implemented that supports on-demand audit record review, analysis, and reporting requirements and after-the-fact investigations of incidents;
• AU-07b.
  • AU-07b.[01] an audit record reduction and report generation capability is provided that does not alter the original content or time ordering of audit records;
  • AU-07b.[02] an audit record reduction and report generation capability is implemented that does not alter the original content or time ordering of audit records.

Assessment Methods

Examine

• Audit and accountability policy
• system security plan
• privacy plan
• procedures addressing audit reduction and report generation
• system design documentation
• system configuration settings and associated documentation
• audit reduction, review, analysis, and reporting tools
• system audit records
• other relevant documents or records

Interview

• Organizational personnel with audit reduction and report generation responsibilities
• organizational personnel with information security and privacy responsibilities

Test

• Audit reduction and report generation capability

Assessment Objective

Determine if:

• AU-07(01)[01] the capability to process, sort, and search audit records for events of interest based on [Assignment: fields within audit records] are provided;
• AU-07(01)[02] the capability to process, sort, and search audit records for events of interest based on [Assignment: fields within audit records] are implemented.

Assessment Methods

Examine

• Audit and accountability policy
• system security plan
• privacy plan
• procedures addressing audit reduction and report generation
• system design documentation
• system configuration settings and associated documentation
• audit reduction, review, analysis, and reporting tools
• audit record criteria (fields) establishing events of interest
• system audit records
• other relevant documents or records

Interview

• Organizational personnel with audit reduction and report generation responsibilities
• organizational personnel with information security and privacy responsibilities
• system developers

Test

• Audit reduction and report generation capability

Assessment Objective

Determine if:

• AU-08a. internal system clocks are used to generate timestamps for audit records;
• AU-08b. timestamps are recorded for audit records that meet [Assignment: granularity of time measurement] and that use Coordinated Universal Time, have a fixed local time offset from Coordinated Universal Time, or include the local time offset as part of the timestamp.

Assessment Methods

Examine

• Audit and accountability policy
• system security plan
• privacy plan
• procedures addressing timestamp generation
• system design documentation
• system configuration settings and associated documentation
• system audit records
• other relevant documents or records

Interview

• Organizational personnel with information security and privacy responsibilities
• system/network administrators
• system developers

Test

• Mechanisms implementing timestamp generation

Assessment Objective

Determine if:

• AU-09a. audit information and audit logging tools are protected from unauthorized access, modification, and deletion;
• AU-09b. [Assignment: personnel or roles] are alerted upon detection of unauthorized access, modification, or deletion of audit information.

Assessment Methods

Examine

• Audit and accountability policy
• system security plan
• privacy plan
• access control policy and procedures
• procedures addressing protection of audit information
• system design documentation
• system configuration settings and associated documentation
• system audit records
• audit tools
• other relevant documents or records

Interview

• Organizational personnel with audit and accountability responsibilities
• organizational personnel with information security and privacy responsibilities
• system/network administrators
• system developers

Test

• Mechanisms implementing audit information protection

Assessment Objective

Determine if:

• AU-09(01) audit trails are written to hardware-enforced, write-once media.

Assessment Methods

Examine

• Audit and accountability policy
• system security plan
• privacy plan
• access control policy and procedures
• procedures addressing protection of audit information
• system design documentation
• system hardware settings
• system configuration settings and associated documentation
• system storage media
• system audit records
• other relevant documents or records

Interview

• Organizational personnel with audit and accountability responsibilities
• organizational personnel with information security and privacy responsibilities
• system/network administrators
• system developers

Test

• System media storing audit trails

Assessment Objective

Determine if:

• AU-09(02) audit records are stored [Assignment: frequency] in a repository that is part of a physically different system or system component than the system or component being audited.

Assessment Methods

Examine

• Audit and accountability policy
• system security plan
• privacy plan
• procedures addressing protection of audit information
• system design documentation
• system configuration settings and associated documentation
• system or media storing backups of system audit records
• system audit records
• other relevant documents or records

Interview

• Organizational personnel with audit and accountability responsibilities
• organizational personnel with information security and privacy responsibilities
• system/network administrators
• system developers

Test

• Mechanisms implementing the backing up of audit records

Assessment Objective

Determine if:

• AU-09(03) cryptographic mechanisms to protect the integrity of audit information and audit tools are implemented.

Assessment Methods

Examine

• Audit and accountability policy
• system security plan
• privacy plan
• access control policy and procedures
• procedures addressing protection of audit information
• system design documentation
• system hardware settings
• system configuration settings and associated documentation
• system audit records
• other relevant documents or records

Interview

• Organizational personnel with audit and accountability responsibilities
• organizational personnel with information security and privacy responsibilities
• system/network administrators
• system developers

Test

• Cryptographic mechanisms protecting the integrity of audit information and tools

Assessment Objective

Determine if:

• AU-09(04) access to management of audit logging functionality is authorized only to [Assignment: subset of privileged users or roles].

Assessment Methods

Examine

• Audit and accountability policy
• system security plan
• privacy plan
• access control policy and procedures
• procedures addressing protection of audit information
• system design documentation
• system configuration settings and associated documentation
• system-generated list of privileged users with access to management of audit functionality
• access authorizations
• access control list
• system audit records
• other relevant documents or records

Interview

• Organizational personnel with audit and accountability responsibilities
• organizational personnel with information security and privacy responsibilities
• system/network administrators

Test

• Mechanisms managing access to audit functionality

Assessment Objective

Determine if:

• AU-09(05) dual authorization is enforced for the [Selection (one or more): movement; deletion] of [Assignment: audit information].

Assessment Methods

Examine

• Audit and accountability policy
• system security plan
• privacy plan
• access control policy and procedures
• procedures addressing protection of audit information
• system design documentation
• system configuration settings and associated documentation
• access authorizations
• system audit records
• other relevant documents or records

Interview

• Organizational personnel with audit and accountability responsibilities
• organizational personnel with information security and privacy responsibilities
• system/network administrators

Test

• Mechanisms implementing the enforcement of dual authorization

Assessment Objective

Determine if:

• AU-09(06) read-only access to audit information is authorized to [Assignment: subset of privileged users or roles].

Assessment Methods

Examine

• Audit and accountability policy
• system security plan
• privacy plan
• access control policy and procedures
• procedures addressing protection of audit information
• system design documentation
• system configuration settings and associated documentation
• system-generated list of privileged users with read-only access to audit information
• access authorizations
• access control list
• system audit records
• other relevant documents or records

Interview

• Organizational personnel with audit and accountability responsibilities
• organizational personnel with information security and privacy responsibilities
• system/network administrators

Test

• Mechanisms managing access to audit information

Assessment Objective

Determine if:

• AU-09(07) audit information is stored on a component running a different operating system than the system or component being audited.

Assessment Methods

Examine

• Audit and accountability policy
• system security plan
• privacy plan
• access control policy and procedures
• procedures addressing protection of audit information
• system design documentation
• system configuration settings and associated documentation
• system audit records
• other relevant documents or records

Interview

• Organizational personnel with audit and accountability responsibilities
• organizational personnel with information security and privacy responsibilities
• system/network administrators

Test

• Mechanisms implementing operating system verification capability
• mechanisms verifying audit information storage location

Assessment Objective

Determine if:

• AU-10 irrefutable evidence is provided that an individual (or process acting on behalf of an individual) has performed [Assignment: actions].

Assessment Methods

Examine

• Audit and accountability policy
• system security plan
• privacy plan
• procedures addressing non-repudiation
• system design documentation
• system configuration settings and associated documentation
• system audit records
• other relevant documents or records

Interview

• Organizational personnel with information security and privacy responsibilities
• system/network administrators
• system developers

Test

• Mechanisms implementing non-repudiation capability

Assessment Objective

Determine if:

• AU-10(01)(a) the identity of the information producer is bound with the information to [Assignment: strength of binding];
• AU-10(01)(b) the means for authorized individuals to determine the identity of the producer of the information is provided.

Assessment Methods

Examine

• Audit and accountability policy
• system security plan
• privacy plan
• procedures addressing non-repudiation
• system design documentation
• system configuration settings and associated documentation
• system audit records
• other relevant documents or records

Interview

• Organizational personnel with information security and privacy responsibilities
• system/network administrators
• system developers

Test

• Mechanisms implementing non-repudiation capability

Assessment Objective

Determine if:

• AU-10(02)(a) the binding of the information producer identity to the information is validated at [Assignment: frequency];
• AU-10(02)(b) [Assignment: actions] in the event of a validation error are performed.

Assessment Methods

Examine

• Audit and accountability policy
• system security plan
• privacy plan
• procedures addressing non-repudiation
• system design documentation
• system configuration settings and associated documentation
• validation records
• system audit records
• other relevant documents or records

Interview

• Organizational personnel with information security and privacy responsibilities
• system/network administrators
• system developers

Test

• Mechanisms implementing non-repudiation capability

Assessment Objective

Determine if:

• AU-10(03) reviewer or releaser credentials are maintained within the established chain of custody for information reviewed or released.

Assessment Methods

Examine

• Audit and accountability policy
• system security plan
• privacy plan
• procedures addressing non-repudiation
• system design documentation
• system configuration settings and associated documentation
• records of information reviews and releases
• system audit records
• other relevant documents or records

Interview

• Organizational personnel with information security and privacy responsibilities
• system/network administrators
• system developers

Test

• Automated mechanisms implementing non-repudiation capability

Assessment Objective

Determine if:

• AU-10(04)(a) the binding of the information reviewer identity to the information at the transfer or release points prior to release or transfer between [Assignment: security domains] is validated;
• AU-10(04)(b) [Assignment: actions] are performed in the event of a validation error.

Assessment Methods

Examine

• Audit and accountability policy
• system security plan
• privacy plan
• procedures addressing non-repudiation
• system design documentation
• system configuration settings and associated documentation
• validation records
• system audit records
• other relevant documents or records

Interview

• Organizational personnel with information security and privacy responsibilities
• system/network administrators
• system developers

Test

• Mechanisms implementing non-repudiation capability

Assessment Objective

Determine if:

• AU-11 audit records are retained for [Assignment: time period] to provide support for after-the-fact investigations of incidents and to meet regulatory and organizational information retention requirements.

Assessment Methods

Examine

• Audit and accountability policy
• system security plan
• privacy plan
• audit record retention policy and procedures
• security plan
• organization-defined retention period for audit records
• audit record archives
• audit logs
• audit records
• other relevant documents or records

Interview

• Organizational personnel with audit record retention responsibilities
• organizational personnel with information security and privacy responsibilities
• system/network administrators

Assessment Objective

Determine if:

• AU-11(01) [Assignment: measures] are employed to ensure that long-term audit records generated by the system can be retrieved.

Assessment Methods

Examine

• Audit and accountability policy
• system security plan
• privacy plan
• audit record retention policy and procedures
• system design documentation
• system configuration settings and associated documentation
• audit record archives
• audit logs
• audit records
• other relevant documents or records

Interview

• Organizational personnel with audit record retention responsibilities
• organizational personnel with information security and privacy responsibilities
• system/network administrators

Test

• Mechanisms implementing audit record retention capability

Assessment Objective

Determine if:

• AU-12a. audit record generation capability for the event types the system is capable of auditing (defined in AU-02_ODP[01]) is provided by [Assignment: system components];
• AU-12b. [Assignment: personnel or roles] is/are allowed to select the event types that are to be logged by specific components of the system;
• AU-12c. audit records for the event types defined in AU-02_ODP[02] that include the audit record content defined in AU-03 are generated.

Assessment Methods

Examine

• Audit and accountability policy
• procedures addressing audit record generation
• system security plan
• privacy plan
• system design documentation
• system configuration settings and associated documentation
• list of auditable events
• system audit records
• other relevant documents or records

Interview

• Organizational personnel with audit record generation responsibilities
• organizational personnel with information security and privacy responsibilities
• system/network administrators
• system developers

Test

• Mechanisms implementing audit record generation capability

Assessment Objective

Determine if:

• AU-12(01) audit records from [Assignment: system components] are compiled into a system-wide (logical or physical) audit trail that is time-correlated to within [Assignment: level of tolerance].

Assessment Methods

Examine

• Audit and accountability policy
• system security plan
• privacy plan
• procedures addressing audit record generation
• system design documentation
• system configuration settings and associated documentation
• system-wide audit trail (logical or physical)
• system audit records
• other relevant documents or records

Interview

• Organizational personnel with audit record generation responsibilities
• organizational personnel with information security and privacy responsibilities
• system/network administrators
• system developers

Test

• Mechanisms implementing audit record generation capability

Assessment Objective

Determine if:

• AU-12(02) a system-wide (logical or physical) audit trail composed of audit records is produced in a standardized format.

Assessment Methods

Examine

• Audit and accountability policy
• system security plan
• privacy plan
• procedures addressing audit record generation
• system design documentation
• system configuration settings and associated documentation
• system-wide audit trail (logical or physical)
• system audit records
• other relevant documents or records

Interview

• Organizational personnel with audit record generation responsibilities
• organizational personnel with security responsibilities
• system/network administrators
• system developers

Test

• Mechanisms implementing audit record generation capability

Assessment Objective

Determine if:

• AU-12(03)[01] the capability for [Assignment: individuals or roles] to change the logging to be performed on [Assignment: system components] based on [Assignment: selectable event criteria] within [Assignment: time thresholds] is provided;
• AU-12(03)[02] the capability for [Assignment: individuals or roles] to change the logging to be performed on [Assignment: system components] based on [Assignment: selectable event criteria] within [Assignment: time thresholds] is implemented.

Assessment Methods

Examine

• Audit and accountability policy
• system security plan
• privacy plan
• procedures addressing audit record generation
• system design documentation
• system configuration settings and associated documentation
• system-generated list of individuals or roles authorized to change auditing to be performed
• system audit records
• other relevant documents or records

Interview

• Organizational personnel with audit record generation responsibilities
• organizational personnel with information security and privacy responsibilities
• system/network administrators
• system developers

Test

• Mechanisms implementing audit record generation capability

Assessment Objective

Determine if:

• AU-12(04)[01] the capability to audit the parameters of user query events for data sets containing personally identifiable information is provided;
• AU-12(04)[02] the capability to audit the parameters of user query events for data sets containing personally identifiable information is implemented.

Assessment Methods

Examine

• Audit and accountability policy
• system security plan
• privacy plan
• procedures addressing audit record generation
• query event records
• system design documentation
• system configuration settings and associated documentation
• map of system data actions
• system audit records
• other relevant documents or records

Interview

• Organizational personnel with audit record generation responsibilities
• organizational personnel with information security and privacy responsibilities
• system/network administrators
• system developers

Test

• Mechanisms implementing audit record generation capability

Assessment Objective

Determine if:

• AU-13a. [Assignment: open-source information and/or information sites] is/are monitored [Assignment: frequency] for evidence of unauthorized disclosure of organizational information;
• AU-13b.
  • AU-13b.01 [Assignment: personnel or roles] are notified if an information disclosure is discovered;
  • AU-13b.02 [Assignment: additional actions] are taken if an information disclosure is discovered.

Assessment Methods

Examine

• Audit and accountability policy
• system security plan
• privacy plan
• procedures addressing information disclosure monitoring
• system design documentation
• system configuration settings and associated documentation
• monitoring records
• system audit records
• other relevant documents or records

Interview

• Organizational personnel with responsibilities for monitoring open-source information and/or information sites
• organizational personnel with security and privacy responsibilities

Test

• Mechanisms implementing monitoring for information disclosure

Assessment Objective

Determine if:

• AU-13(01) open-source information and information sites are monitored using [Assignment: automated mechanisms].

Assessment Methods

Examine

• Audit and accountability policy
• system security plan
• privacy plan
• procedures addressing information disclosure monitoring
• system design documentation
• system configuration settings and associated documentation
• automated monitoring tools
• system audit records
• other relevant documents or records

Interview

• Organizational personnel with responsibilities for monitoring information disclosures
• organizational personnel with information security and privacy responsibilities

Test

• Automated mechanisms implementing monitoring for information disclosure

Assessment Objective

Determine if:

• AU-13(02) the list of open-source information sites being monitored is reviewed [Assignment: frequency].

Assessment Methods

Examine

• Audit and accountability policy
• system security plan
• privacy plan
• procedures addressing information disclosure monitoring
• system design documentation
• system configuration settings and associated documentation
• reviews for open-source information sites being monitored
• system audit records
• other relevant documents or records

Interview

• Organizational personnel with responsibilities for monitoring open-source information sites
• organizational personnel with information security and privacy responsibilities

Test

• Mechanisms implementing monitoring for information disclosure

Assessment Objective

Determine if:

• AU-13(03) discovery techniques, processes, and tools are employed to determine if external entities are replicating organizational information in an unauthorized manner.

Assessment Methods

Examine

• Audit and accountability policy
• system security plan
• privacy plan
• procedures addressing information disclosure monitoring
• procedures addressing information replication
• system design documentation
• system configuration settings and associated documentation
• system audit records
• training resources for staff to recognize the unauthorized use of organizational information
• other relevant documents or records

Interview

• Organizational personnel with responsibilities for monitoring unauthorized replication of information
• organizational personnel with information security and privacy responsibilities

Test

• Discovery tools for identifying unauthorized information replication

Assessment Objective

Determine if:

• AU-14a.
  • AU-14a.[01] [Assignment: users or roles] are provided with the capability to [Selection (one or more): record; view; hear; log] the content of a user session under [Assignment: circumstances];
  • AU-14a.[02] the capability for [Assignment: users or roles] to [Selection (one or more): record; view; hear; log] the content of a user session under [Assignment: circumstances] is implemented;
• AU-14b.
  • AU-14b.[01] session auditing activities are developed in consultation with legal counsel and in accordance with applicable laws, executive orders, directives, regulations, policies, standards, and guidelines;
  • AU-14b.[02] session auditing activities are integrated in consultation with legal counsel and in accordance with applicable laws, executive orders, directives, regulations, policies, standards, and guidelines;
  • AU-14b.[03] session auditing activities are used in consultation with legal counsel and in accordance with applicable laws, executive orders, directives, regulations, policies, standards, and guidelines;

Assessment Methods

Examine

• Audit and accountability policy
• system security plan
• privacy plan
• procedures addressing user session auditing
• system design documentation
• system configuration settings and associated documentation
• system audit records
• other relevant documents or records

Interview

• Organizational personnel with information security and privacy responsibilities
• system/network administrators
• system developers
• legal counsel
• personnel with civil liberties responsibilities

Test

• Mechanisms implementing user session auditing capability

Assessment Objective

Determine if:

• AU-14(01) session audits are initiated automatically at system start-up.

Assessment Methods

Examine

• Audit and accountability policy
• system security plan
• privacy plan
• procedures addressing user session auditing
• system design documentation
• system configuration settings and associated documentation
• system audit records
• other relevant documents or records

Interview

• Organizational personnel with information security and privacy responsibilities
• system/network administrators
• system developers

Test

• Mechanisms implementing user session auditing capability

Assessment Objective

Determine if:

• AU-14(03)[01] the capability for authorized users to remotely view and hear content related to an established user session in real time is provided;
• AU-14(03)[02] the capability for authorized users to remotely view and hear content related to an established user session in real time is implemented.

Assessment Methods

Examine

• Audit and accountability policy
• system security plan
• privacy plan
• procedures addressing user session auditing
• system design documentation
• system configuration settings and associated documentation
• system audit records
• other relevant documents or records

Interview

• Organizational personnel with information security and privacy responsibilities
• system/network administrators
• system developers
• legal counsel
• personnel with civil liberties responsibilities

Test

• Mechanisms implementing user session auditing capability

Assessment Objective

Determine if:

• AU-16 [Assignment: methods] for coordinating [Assignment: audit information] among external organizations when audit information is transmitted across organizational boundaries are employed.

Assessment Methods

Examine

• Audit and accountability policy
• system security plan
• privacy plan
• procedures addressing methods for coordinating audit information among external organizations
• system design documentation
• system configuration settings and associated documentation
• system audit records
• other relevant documents or records

Interview

• Organizational personnel with responsibilities for coordinating audit information among external organizations
• organizational personnel with information security and privacy responsibilities

Test

• Mechanisms implementing cross-organizational auditing

Assessment Objective

Determine if:

• AU-16(01) the identity of individuals in cross-organizational audit trails is preserved.

Assessment Methods

Examine

• Audit and accountability policy
• system security plan
• privacy plan
• procedures addressing cross-organizational audit trails
• system design documentation
• system configuration settings and associated documentation
• system audit records
• other relevant documents or records

Interview

• Organizational personnel with cross-organizational audit responsibilities
• organizational personnel with information security and privacy responsibilities

Test

• Mechanisms implementing cross-organizational auditing (if applicable)

Assessment Objective

Determine if:

• AU-16(02) cross-organizational audit information is provided to [Assignment: organizations] based on [Assignment: cross-organizational sharing agreements].

Assessment Methods

Examine

• Audit and accountability policy
• system security plan
• privacy plan
• procedures addressing cross-organizational sharing of audit information
• information sharing agreements
• other relevant documents or records

Interview

• Organizational personnel with responsibilities for sharing cross-organizational audit information
• organizational personnel with information security and privacy responsibilities

Assessment Objective

Determine if:

• AU-16(03) [Assignment: measures] are implemented to disassociate individuals from audit information transmitted across organizational boundaries.

Assessment Methods

Examine

• Audit and accountability policy
• system security plan
• privacy plan
• procedures addressing cross-organizational sharing of audit information
• policy and/or procedures regarding the deidentification of PII
• system design documentation
• system configuration settings and associated documentation
• system audit records
• other relevant documents or records

Interview

• Organizational personnel with responsibilities for sharing cross-organizational audit information
• organizational personnel with information security and privacy responsibilities

Test

• Mechanisms implementing disassociability

Assessment Objective

Determine if:

• CA-01a.
  • CA-01a.[01] an assessment, authorization, and monitoring policy is developed and documented;
  • CA-01a.[02] the assessment, authorization, and monitoring policy is disseminated to [Assignment: personnel or roles];
  • CA-01a.[03] assessment, authorization, and monitoring procedures to facilitate the implementation of the assessment, authorization, and monitoring policy and associated assessment, authorization, and monitoring controls are developed and documented;
  • CA-01a.[04] the assessment, authorization, and monitoring procedures are disseminated to [Assignment: personnel or roles];
  • CA-01a.01
    • CA-01a.01(a)
      • CA-01a.01(a)[01] the [Selection (one or more): organization-level; mission/business process-level; system-level] assessment, authorization, and monitoring policy addresses purpose;
      • CA-01a.01(a)[02] the [Selection (one or more): organization-level; mission/business process-level; system-level] assessment, authorization, and monitoring policy addresses scope;
      • CA-01a.01(a)[03] the [Selection (one or more): organization-level; mission/business process-level; system-level] assessment, authorization, and monitoring policy addresses roles;
      • CA-01a.01(a)[04] the [Selection (one or more): organization-level; mission/business process-level; system-level] assessment, authorization, and monitoring policy addresses responsibilities;
      • CA-01a.01(a)[05] the [Selection (one or more): organization-level; mission/business process-level; system-level] assessment, authorization, and monitoring policy addresses management commitment;
      • CA-01a.01(a)[06] the [Selection (one or more): organization-level; mission/business process-level; system-level] assessment, authorization, and monitoring policy addresses coordination among organizational entities;
      • CA-01a.01(a)[07] the [Selection (one or more): organization-level; mission/business process-level; system-level] assessment, authorization, and monitoring policy addresses compliance;
    • CA-01a.01(b) the [Selection (one or more): organization-level; mission/business process-level; system-level] assessment, authorization, and monitoring policy is consistent with applicable laws, executive orders, directives, regulations, policies, standards, and guidelines;
• CA-01b. the [Assignment: official] is designated to manage the development, documentation, and dissemination of the assessment, authorization, and monitoring policy and procedures;
• CA-01c.
  • CA-01c.01
    • CA-01c.01[01] the current assessment, authorization, and monitoring policy is reviewed and updated [Assignment: frequency];
    • CA-01c.01[02] the current assessment, authorization, and monitoring policy is reviewed and updated following [Assignment: events];
  • CA-01c.02
    • CA-01c.02[01] the current assessment, authorization, and monitoring procedures are reviewed and updated [Assignment: frequency];
    • CA-01c.02[02] the current assessment, authorization, and monitoring procedures are reviewed and updated following [Assignment: events].

Assessment Methods

Examine

• Assessment, authorization, and monitoring policy and procedures
• system security plan
• privacy plan
• other relevant documents or records

Interview

• Organizational personnel with assessment, authorization, and monitoring policy responsibilities
• organizational personnel with information security and privacy responsibilities

Assessment Objective

Determine if:

• CA-02a. an appropriate assessor or assessment team is selected for the type of assessment to be conducted;
• CA-02b.
  • CA-02b.01 a control assessment plan is developed that describes the scope of the assessment, including controls and control enhancements under assessment;
  • CA-02b.02 a control assessment plan is developed that describes the scope of the assessment, including assessment procedures to be used to determine control effectiveness;
  • CA-02b.03
    • CA-02b.03[01] a control assessment plan is developed that describes the scope of the assessment, including the assessment environment;
    • CA-02b.03[02] a control assessment plan is developed that describes the scope of the assessment, including the assessment team;
    • CA-02b.03[03] a control assessment plan is developed that describes the scope of the assessment, including assessment roles and responsibilities;
• CA-02c. the control assessment plan is reviewed and approved by the authorizing official or designated representative prior to conducting the assessment;
• CA-02d.
  • CA-02d.[01] controls are assessed in the system and its environment of operation [Assignment: assessment frequency] to determine the extent to which the controls are implemented correctly, operating as intended, and producing the desired outcome with respect to meeting established security requirements;
  • CA-02d.[02] controls are assessed in the system and its environment of operation [Assignment: assessment frequency] to determine the extent to which the controls are implemented correctly, operating as intended, and producing the desired outcome with respect to meeting established privacy requirements;
• CA-02e. a control assessment report is produced that documents the results of the assessment;
• CA-02f. the results of the control assessment are provided to [Assignment: individuals or roles].

Assessment Methods

Examine

• Assessment, authorization, and monitoring policy
• procedures addressing assessment planning
• procedures addressing control assessments
• control assessment plan
• control assessment report
• system security plan
• privacy plan
• other relevant documents or records

Interview

• Organizational personnel with control assessment responsibilities
• organizational personnel with information security and privacy responsibilities

Test

• Mechanisms supporting control assessment, control assessment plan development, and/or control assessment reporting

Assessment Objective

Determine if:

• CA-02(01) independent assessors or assessment teams are employed to conduct control assessments.

Assessment Methods

Examine

• Assessment, authorization, and monitoring policy
• procedures addressing control assessments
• previous control assessment plan
• previous control assessment report
• plan of action and milestones
• existing authorization statement
• system security plan
• privacy plan
• other relevant documents or records

Interview

• Organizational personnel with security assessment responsibilities
• organizational personnel with information security and privacy responsibilities

Assessment Objective

Determine if:

• CA-02(02) [Assignment: specialized assessment frequency] [Selection: announced; unannounced] [Selection (one or more): in-depth monitoring; security instrumentation; automated security test cases; vulnerability scanning; malicious user testing; insider threat assessment; performance and load testing; data leakage or data loss assessment; [Assignment: other forms of assessment] ] are included as part of control assessments.

Assessment Methods

Examine

• Assessment, authorization, and monitoring policy
• procedures addressing control assessments
• control assessment plan
• control assessment report
• control assessment evidence
• system security plan
• privacy plan
• other relevant documents or records

Interview

• Organizational personnel with control assessment responsibilities
• organizational personnel with information security and privacy responsibilities

Test

• Mechanisms supporting control assessment

Assessment Objective

Determine if:

• CA-02(03) the results of control assessments performed by [Assignment: external organization(s)] on [Assignment: system] are leveraged when the assessment meets [Assignment: requirements].

Assessment Methods

Examine

• Assessment, authorization, and monitoring policy
• procedures addressing control assessments
• control assessment requirements
• control assessment plan
• control assessment report
• control assessment evidence
• plan of action and milestones
• system security plan
• privacy plan
• other relevant documents or records

Interview

• Organizational personnel with control assessment responsibilities
• organizational personnel with information security and privacy responsibilities
• personnel performing control assessments for the specified external organization

Assessment Objective

Determine if:

• CA-03a. the exchange of information between the system and other systems is approved and managed using [Selection (one or more): interconnection security agreements; information exchange security agreements; memoranda of understanding or agreement; service level agreements; user agreements; non-disclosure agreements; [Assignment: type of agreement] ];
• CA-03b.
  • CA-03b.[01] the interface characteristics are documented as part of each exchange agreement;
  • CA-03b.[02] security requirements are documented as part of each exchange agreement;
  • CA-03b.[03] privacy requirements are documented as part of each exchange agreement;
  • CA-03b.[04] controls are documented as part of each exchange agreement;
  • CA-03b.[05] responsibilities for each system are documented as part of each exchange agreement;
  • CA-03b.[06] the impact level of the information communicated is documented as part of each exchange agreement;
• CA-03c. agreements are reviewed and updated [Assignment: frequency].

Assessment Methods

Examine

• Access control policy
• procedures addressing system connections
• system and communications protection policy
• system interconnection security agreements
• information exchange security agreements
• memoranda of understanding or agreements
• service level agreements
• non-disclosure agreements
• system design documentation
• enterprise architecture
• system architecture
• system configuration settings and associated documentation
• system security plan
• privacy plan
• other relevant documents or records

Interview

• Organizational personnel with responsibilities for developing, implementing, or approving system interconnection agreements
• organizational personnel with information security and privacy responsibilities
• personnel managing the system(s) to which the interconnection security agreement applies

Assessment Objective

Determine if:

• CA-03(06) individuals or systems transferring data between interconnecting systems have the requisite authorizations (i.e., write permissions or privileges) prior to accepting such data.

Assessment Methods

Examine

• Access control policy
• procedures addressing system connections
• system and communications protection policy
• system interconnection agreements
• information exchange security agreements
• memoranda of understanding or agreements
• service level agreements
• non-disclosure agreements
• system design documentation
• system configuration settings and associated documentation
• control assessment report
• system audit records
• system security plan
• privacy plan
• other relevant documents or records

Interview

• Organizational personnel with responsibilities for managing connections to external systems
• network administrators
• organizational personnel with information security and privacy responsibilities

Test

• Mechanisms implementing restrictions on external system connections

Assessment Objective

Determine if:

• CA-03(07)(a) transitive (downstream) information exchanges with other systems through the systems identified in CA-03a are identified;
• CA-03(07)(b) measures are taken to ensure that transitive (downstream) information exchanges cease when the controls on identified transitive (downstream) systems cannot be verified or validated.

Assessment Methods

Examine

• Access control policy
• procedures addressing system connections
• system and communications protection policy
• system interconnection agreements
• information exchange security agreements
• memoranda of understanding or agreements
• service level agreements
• non-disclosure agreements
• system design documentation
• system configuration settings and associated documentation
• control assessment report
• system audit records
• system security plan
• privacy plan
• other relevant documents or records

Interview

• Organizational personnel with responsibilities for managing connections to external systems
• network administrators
• organizational personnel with information security and privacy responsibilities

Test

• Mechanisms implementing restrictions on external system connections

Assessment Objective

Determine if:

• CA-05a. a plan of action and milestones for the system is developed to document the planned remediation actions of the organization to correct weaknesses or deficiencies noted during the assessment of the controls and to reduce or eliminate known vulnerabilities in the system;
• CA-05b. existing plan of action and milestones are updated [Assignment: frequency] based on the findings from control assessments, independent audits or reviews, and continuous monitoring activities.

Assessment Methods

Examine

• Assessment, authorization, and monitoring policy
• procedures addressing plan of action and milestones
• control assessment plan
• control assessment report
• control assessment evidence
• plan of action and milestones
• system security plan
• privacy plan
• other relevant documents or records

Interview

• Organizational personnel with plan of action and milestones development and implementation responsibilities
• organizational personnel with information security and privacy responsibilities

Test

• Mechanisms for developing, implementing, and maintaining plan of action and milestones

Assessment Objective

Determine if:

• CA-05(01) [Assignment: automated mechanisms] are used to ensure the accuracy, currency, and availability of the plan of action and milestones for the system.

Assessment Methods

Examine

• Assessment, authorization, and monitoring policy
• procedures addressing plan of action and milestones
• system design documentation
• system configuration settings and associated documentation
• system audit records
• plan of action and milestones
• system security plan
• privacy plan
• other relevant documents or records

Interview

• Organizational personnel with plan of action and milestones development and implementation responsibilities
• organizational personnel with information security and privacy responsibilities

Test

• Automated mechanisms for developing, implementing, and maintaining a plan of action and milestones

Assessment Objective

Determine if:

• CA-06a. a senior official is assigned as the authorizing official for the system;
• CA-06b. a senior official is assigned as the authorizing official for common controls available for inheritance by organizational systems;
• CA-06c.
  • CA-06c.01 before commencing operations, the authorizing official for the system accepts the use of common controls inherited by the system;
  • CA-06c.02 before commencing operations, the authorizing official for the system authorizes the system to operate;
• CA-06d. the authorizing official for common controls authorizes the use of those controls for inheritance by organizational systems;
• CA-06e. the authorizations are updated [Assignment: frequency].

Assessment Methods

Examine

• Assessment, authorization, and monitoring policy
• procedures addressing authorization
• system security plan, privacy plan, assessment report, plan of action and milestones
• authorization statement
• other relevant documents or records

Interview

• Organizational personnel with authorization responsibilities
• organizational personnel with information security and privacy responsibilities

Test

• Mechanisms that facilitate authorizations and updates

Assessment Objective

Determine if:

• CA-06(01)[01] a joint authorization process is employed for the system;
• CA-06(01)[02] the joint authorization process employed for the system includes multiple authorizing officials from the same organization conducting the authorization.

Assessment Methods

Examine

• Assessment, authorization, and monitoring policy
• procedures addressing authorization
• system security plan
• privacy plan
• assessment report
• plan of action and milestones
• authorization statement
• other relevant documents or records

Interview

• Organizational personnel with authorization responsibilities
• organizational personnel with information security and privacy responsibilities

Test

• Mechanisms that facilitate authorizations and updates

Assessment Objective

Determine if:

• CA-06(02)[01] a joint authorization process is employed for the system;
• CA-06(02)[02] the joint authorization process employed for the system includes multiple authorizing officials with at least one authorizing official from an organization external to the organization conducting the authorization.

Assessment Methods

Examine

• Assessment, authorization, and monitoring policy
• procedures addressing authorization
• system security plan
• privacy plan
• assessment report
• plan of action and milestones
• authorization statement
• other relevant documents or records

Interview

• Organizational personnel with authorization responsibilities
• organizational personnel with information security and privacy responsibilities

Test

• Mechanisms that facilitate authorizations and updates

Assessment Objective

Determine if:

• CA-07[01] a system-level continuous monitoring strategy is developed;
• CA-07[02] system-level continuous monitoring is implemented in accordance with the organization-level continuous monitoring strategy;
• CA-07a. system-level continuous monitoring includes establishment of the following system-level metrics to be monitored: [Assignment: system-level metrics];
• CA-07b.
  • CA-07b.[01] system-level continuous monitoring includes established [Assignment: frequencies] for monitoring;
  • CA-07b.[02] system-level continuous monitoring includes established [Assignment: frequencies] for assessment of control effectiveness;
• CA-07c. system-level continuous monitoring includes ongoing control assessments in accordance with the continuous monitoring strategy;
• CA-07d. system-level continuous monitoring includes ongoing monitoring of system and organization-defined metrics in accordance with the continuous monitoring strategy;
• CA-07e. system-level continuous monitoring includes correlation and analysis of information generated by control assessments and monitoring;
• CA-07f. system-level continuous monitoring includes response actions to address the results of the analysis of control assessment and monitoring information;
• CA-07g.
  • CA-07g.[01] system-level continuous monitoring includes reporting the security status of the system to [Assignment: personnel or roles] [Assignment: frequency];
  • CA-07g.[02] system-level continuous monitoring includes reporting the privacy status of the system to [Assignment: personnel or roles] [Assignment: frequency].

Assessment Methods

Examine

• Assessment, authorization, and monitoring policy
• organizational continuous monitoring strategy
• system-level continuous monitoring strategy
• procedures addressing continuous monitoring of system controls
• procedures addressing configuration management
• control assessment report
• plan of action and milestones
• system monitoring records
• configuration management records
• impact analyses
• status reports
• system security plan
• privacy plan
• other relevant documents or records

Interview

• Organizational personnel with continuous monitoring responsibilities
• organizational personnel with information security and privacy responsibilities
• system/network administrators

Test

• Mechanisms implementing continuous monitoring
• mechanisms supporting response actions to address assessment and monitoring results
• mechanisms supporting security and privacy status reporting

Assessment Objective

Determine if:

• CA-07(01) independent assessors or assessment teams are employed to monitor the controls in the system on an ongoing basis.

Assessment Methods

Examine

• Assessment, authorization, and monitoring policy
• organizational continuous monitoring strategy
• system-level continuous monitoring strategy
• procedures addressing continuous monitoring of system controls
• control assessment report
• plan of action and milestones
• system monitoring records
• impact analyses
• status reports
• system security plan
• privacy plan
• other relevant documents or records

Interview

• Organizational personnel with continuous monitoring responsibilities
• organizational personnel with information security and privacy responsibilities

Assessment Objective

Determine if:

• CA-07(03)[01] trend analysis is employed to determine if control implementations used in the continuous monitoring process need to be modified based on empirical data;
• CA-07(03)[02] trend analysis is employed to determine if the frequency of continuous monitoring activities used in the continuous monitoring process needs to be modified based on empirical data;
• CA-07(03)[03] trend analysis is employed to determine if the types of activities used in the continuous monitoring process need to be modified based on empirical data.

Assessment Methods

Examine

• Organizational continuous monitoring strategy
• system-level continuous monitoring strategy
• assessment, authorization, and monitoring policy
• procedures addressing continuous monitoring of system controls
• privacy controls
• assessment report
• plan of action and milestones
• system monitoring records
• impact analyses
• status reports
• system security plan
• privacy plan
• other relevant documents or records

Interview

• Organizational personnel with continuous monitoring responsibilities
• organizational personnel with information security and privacy responsibilities

Test

• Mechanisms supporting trend analyses

Assessment Objective

Determine if:

• CA-07(04) risk monitoring is an integral part of the continuous monitoring strategy;
  • CA-07(04)(a) effectiveness monitoring is included in risk monitoring;
  • CA-07(04)(b) compliance monitoring is included in risk monitoring;
  • CA-07(04)(c) change monitoring is included in risk monitoring.

Assessment Methods

Examine

• Assessment, authorization, and monitoring policy
• organizational continuous monitoring strategy
• system-level continuous monitoring strategy
• procedures addressing continuous monitoring of system controls
• assessment report
• plan of action and milestones
• system monitoring records
• impact analyses
• status reports
• system security plan
• privacy plan
• other relevant documents or records

Interview

• Organizational personnel with continuous monitoring responsibilities
• organizational personnel with information security and privacy responsibilities

Test

• Mechanisms supporting risk monitoring

Assessment Objective

Determine if:

• CA-07(05)[01] [Assignment: actions] are employed to validate that policies are established;
• CA-07(05)[02] [Assignment: actions] are employed to validate that implemented controls are operating in a consistent manner.

Assessment Methods

Examine

• Assessment, authorization, and monitoring policy
• organizational continuous monitoring strategy
• system-level continuous monitoring strategy
• procedures addressing continuous monitoring of system security controls
• assessment report
• plan of action and milestones
• system monitoring records
• security impact analyses
• status reports
• system security plan
• other relevant documents or records

Interview

• Organizational personnel with continuous monitoring responsibilities
• organizational personnel with information security and privacy responsibilities

Test

• Mechanisms supporting consistency analyses

Assessment Objective

Determine if:

• CA-07(06) [Assignment: automated mechanisms] are used to ensure the accuracy, currency, and availability of monitoring results for the system.

Assessment Methods

Examine

• Assessment, authorization, and monitoring policy
• organizational continuous monitoring strategy
• system-level continuous monitoring strategy
• procedures addressing continuous monitoring of system controls
• assessment report
• plan of action and milestones
• system monitoring records
• impact analyses
• status reports
• system security plan
• privacy plan
• other relevant documents or records

Interview

• Organizational personnel with continuous monitoring responsibilities
• organizational personnel with information security and privacy responsibilities

Test

• Mechanisms supporting automated monitoring

Assessment Objective

Determine if:

• CA-08 penetration testing is conducted [Assignment: frequency] on [Assignment: system(s) or system components].

Assessment Methods

Examine

• Assessment, authorization, and monitoring policy
• procedures addressing penetration testing
• assessment plan
• penetration test report
• assessment report
• assessment evidence
• system security plan
• privacy plan
• other relevant documents or records

Interview

• Organizational personnel with control assessment responsibilities
• organizational personnel with information security and privacy responsibilities
• system/network administrators

Test

• Mechanisms supporting penetration testing

Assessment Objective

Determine if:

• CA-08(01) an independent penetration testing agent or team is employed to perform penetration testing on the system or system components.

Assessment Methods

Examine

• Assessment, authorization, and monitoring policy
• procedures addressing penetration testing
• assessment plan
• penetration test report
• assessment report
• security assessment evidence
• system security plan
• privacy plan
• other relevant documents or records

Interview

• Organizational personnel with assessment responsibilities
• organizational personnel with information security and privacy responsibilities

Assessment Objective

Determine if:

• CA-08(02) [Assignment: red team exercises] are employed to simulate attempts by adversaries to compromise organizational systems in accordance with applicable rules of engagement.

Assessment Methods

Examine

• Assessment, authorization, and monitoring policy
• procedures addressing penetration testing
• procedures addressing red team exercises
• assessment plan
• results of red team exercises
• penetration test report
• assessment report
• rules of engagement
• assessment evidence
• system security plan
• privacy plan
• other relevant documents or records

Interview

• Organizational personnel with assessment responsibilities
• organizational personnel with information security and privacy responsibilities
• system/network administrators

Test

• Mechanisms supporting the employment of red team exercises

Assessment Objective

Determine if:

• CA-08(03) the penetration testing process includes [Assignment: frequency] [Selection (one or more): announced; unannounced] attempts to bypass or circumvent controls associated with physical access points to facility.

Assessment Methods

Examine

• Assessment, authorization, and monitoring policy
• procedures addressing penetration testing
• procedures addressing red team exercises
• assessment plan
• results of red team exercises
• penetration test report
• assessment report
• rules of engagement
• assessment evidence
• system security plan
• privacy plan
• other relevant documents or records

Interview

• Organizational personnel with assessment responsibilities
• organizational personnel with information security and privacy responsibilities
• system/network administrators

Test

• Automated mechanisms supporting the employment of red team exercises

Assessment Objective

Determine if:

• CA-09a. internal connections of [Assignment: system components] to the system are authorized;
• CA-09b.
  • CA-09b.[01] for each internal connection, the interface characteristics are documented;
  • CA-09b.[02] for each internal connection, the security requirements are documented;
  • CA-09b.[03] for each internal connection, the privacy requirements are documented;
  • CA-09b.[04] for each internal connection, the nature of the information communicated is documented;
• CA-09c. internal system connections are terminated after [Assignment: conditions];
• CA-09d. the continued need for each internal connection is reviewed [Assignment: frequency].

Assessment Methods

Examine

• Assessment, authorization, and monitoring policy
• access control policy
• procedures addressing system connections
• system and communications protection policy
• system design documentation
• system configuration settings and associated documentation
• list of components or classes of components authorized as internal system connections
• assessment report
• system audit records
• system security plan
• privacy plan
• other relevant documents or records

Interview

• Organizational personnel with responsibilities for developing, implementing, or authorizing internal system connections
• organizational personnel with information security and privacy responsibilities

Test

• Mechanisms supporting internal system connections

Assessment Objective

Determine if:

• CA-09(01)[01] security compliance checks are performed on constituent system components prior to the establishment of the internal connection;
• CA-09(01)[02] privacy compliance checks are performed on constituent system components prior to the establishment of the internal connection.

Assessment Methods

Examine

• Assessment, authorization, and monitoring policy
• access control policy
• procedures addressing system connections
• system and communications protection policy
• system design documentation
• system configuration settings and associated documentation
• list of components or classes of components authorized as internal system connections
• assessment report
• system audit records
• system security plan
• privacy plan
• other relevant documents or records

Interview

• Organizational personnel with responsibilities for developing, implementing, or authorizing internal system connections
• organizational personnel with information security and privacy responsibilities

Test

• Mechanisms supporting compliance checks

Assessment Objective

Determine if:

• CM-01a.
  • CM-01a.[01] a configuration management policy is developed and documented;
  • CM-01a.[02] the configuration management policy is disseminated to [Assignment: personnel or roles];
  • CM-01a.[03] configuration management procedures to facilitate the implementation of the configuration management policy and associated configuration management controls are developed and documented;
  • CM-01a.[04] the configuration management procedures are disseminated to [Assignment: personnel or roles];
  • CM-01a.01
    • CM-01a.01(a)
      • CM-01a.01(a)[01] the [Selection (one or more): organization-level; mission/business process-level; system-level] of the configuration management policy addresses purpose;
      • CM-01a.01(a)[02] the [Selection (one or more): organization-level; mission/business process-level; system-level] of the configuration management policy addresses scope;
      • CM-01a.01(a)[03] the [Selection (one or more): organization-level; mission/business process-level; system-level] of the configuration management policy addresses roles;
      • CM-01a.01(a)[04] the [Selection (one or more): organization-level; mission/business process-level; system-level] of the configuration management policy addresses responsibilities;
      • CM-01a.01(a)[05] the [Selection (one or more): organization-level; mission/business process-level; system-level] of the configuration management policy addresses management commitment;
      • CM-01a.01(a)[06] the [Selection (one or more): organization-level; mission/business process-level; system-level] of the configuration management policy addresses coordination among organizational entities;
      • CM-01a.01(a)[07] the [Selection (one or more): organization-level; mission/business process-level; system-level] of the configuration management policy addresses compliance;
    • CM-01a.01(b) the configuration management policy is consistent with applicable laws, Executive Orders, directives, regulations, policies, standards, and guidelines;
• CM-01b. the [Assignment: official] is designated to manage the development, documentation, and dissemination of the configuration management policy and procedures;
• CM-01c.
  • CM-01c.01
    • CM-01c.01[01] the current configuration management policy is reviewed and updated [Assignment: frequency];
    • CM-01c.01[02] the current configuration management policy is reviewed and updated following [Assignment: events];
  • CM-01c.02
    • CM-01c.02[01] the current configuration management procedures are reviewed and updated [Assignment: frequency];
    • CM-01c.02[02] the current configuration management procedures are reviewed and updated following [Assignment: events].

Assessment Methods

Examine

• Configuration management policy and procedures
• security and privacy program policies and procedures
• assessment or audit findings
• documentation of security incidents or breaches
• system security plan
• privacy plan
• risk management strategy
• other relevant artifacts, documents, or records

Interview

• Organizational personnel with configuration management responsibilities
• organizational personnel with information security and privacy responsibilities

Assessment Objective

Determine if:

• CM-02a.
  • CM-02a.[01] a current baseline configuration of the system is developed and documented;
  • CM-02a.[02] a current baseline configuration of the system is maintained under configuration control;
• CM-02b.
  • CM-02b.01 the baseline configuration of the system is reviewed and updated [Assignment: frequency];
  • CM-02b.02 the baseline configuration of the system is reviewed and updated when required due to [Assignment: circumstances];
  • CM-02b.03 the baseline configuration of the system is reviewed and updated when system components are installed or upgraded.

Assessment Methods

Examine

• Configuration management policy
• procedures addressing the baseline configuration of the system
• configuration management plan
• enterprise architecture documentation
• system design documentation
• system security plan
• privacy plan
• system architecture and configuration documentation
• system configuration settings and associated documentation
• system component inventory
• change control records
• other relevant documents or records

Interview

• Organizational personnel with configuration management responsibilities
• organizational personnel with information security and privacy responsibilities
• system/network administrators

Test

• Organizational processes for managing baseline configurations
• mechanisms supporting configuration control of the baseline configuration

Assessment Objective

Determine if:

• CM-02(02)[01] the currency of the baseline configuration of the system is maintained using [Assignment: automated mechanisms];
• CM-02(02)[02] the completeness of the baseline configuration of the system is maintained using [Assignment: automated mechanisms];
• CM-02(02)[03] the accuracy of the baseline configuration of the system is maintained using [Assignment: automated mechanisms];
• CM-02(02)[04] the availability of the baseline configuration of the system is maintained using [Assignment: automated mechanisms].

Assessment Methods

Examine

• Configuration management policy
• procedures addressing the baseline configuration of the system
• configuration management plan
• system design documentation
• system architecture and configuration documentation
• system configuration settings and associated documentation
• system component inventory
• configuration change control records
• system security plan
• other relevant documents or records

Interview

• Organizational personnel with configuration management responsibilities
• organizational personnel with information security responsibilities
• system/network administrators

Test

• Organizational processes for managing baseline configurations
• automated mechanisms implementing baseline configuration maintenance

Assessment Objective

Determine if:

• CM-02(03) [Assignment: number] of previous baseline configuration version(s) of the system is/are retained to support rollback.

Assessment Methods

Examine

• Configuration management policy
• procedures addressing the baseline configuration of the system
• configuration management plan
• system architecture and configuration documentation
• system configuration settings and associated documentation
• copies of previous baseline configuration versions
• system security plan
• other relevant documents or records

Interview

• Organizational personnel with configuration management responsibilities
• organizational personnel with information security responsibilities
• system/network administrators

Test

• Organizational processes for managing baseline configurations

Assessment Objective

Determine if:

• CM-02(06)[01] a baseline configuration for system development environments that is managed separately from the operational baseline configuration is maintained;
• CM-02(06)[02] a baseline configuration for test environments that is managed separately from the operational baseline configuration is maintained.

Assessment Methods

Examine

• Configuration management policy
• procedures addressing the baseline configuration of the system
• configuration management plan
• system design documentation
• system architecture and configuration documentation
• system configuration settings and associated documentation
• system security plan
• other relevant documents or records

Interview

• Organizational personnel with configuration management responsibilities
• organizational personnel with information security responsibilities
• system/network administrators

Test

• Organizational processes for managing baseline configurations
• mechanisms implementing separate baseline configurations for development, test, and operational environments

Assessment Objective

Determine if:

• CM-02(07)(a) [Assignment: systems or system components] with [Assignment: configurations] are issued to individuals traveling to locations that the organization deems to be of significant risk;
• CM-02(07)(b) [Assignment: controls] are applied to the systems or system components when the individuals return from travel.

Assessment Methods

Examine

• Configuration management policy
• configuration management plan
• procedures addressing the baseline configuration of the system
• procedures addressing system component installations and upgrades
• system architecture and configuration documentation
• system configuration settings and associated documentation
• system component inventory
• records of system baseline configuration reviews and updates
• system component installations/upgrades and associated records
• change control records
• system security plan
• other relevant documents or records

Interview

• Organizational personnel with configuration management responsibilities
• organizational personnel with information security responsibilities
• system/network administrators

Test

• Organizational processes for managing baseline configurations

Assessment Objective

Determine if:

• CM-03a. the types of changes to the system that are configuration-controlled are determined and documented;
• CM-03b.
  • CM-03b.[01] proposed configuration-controlled changes to the system are reviewed;
  • CM-03b.[02] proposed configuration-controlled changes to the system are approved or disapproved with explicit consideration for security and privacy impact analyses;
• CM-03c. configuration change decisions associated with the system are documented;
• CM-03d. approved configuration-controlled changes to the system are implemented;
• CM-03e. records of configuration-controlled changes to the system are retained for [Assignment: time period];
• CM-03f.
  • CM-03f.[01] activities associated with configuration-controlled changes to the system are monitored;
  • CM-03f.[02] activities associated with configuration-controlled changes to the system are reviewed;
• CM-03g.
  • CM-03g.[01] configuration change control activities are coordinated and overseen by [Assignment: configuration change control element];
  • CM-03g.[02] the configuration control element convenes [Selection (one or more): [Assignment: frequency] ; when [Assignment: configuration change conditions] ].

Assessment Methods

Examine

• Configuration management policy
• procedures addressing system configuration change control
• configuration management plan
• system architecture and configuration documentation
• change control records
• system audit records
• change control audit and review reports
• agenda/minutes/documentation from configuration change control oversight meetings
• system security plan
• privacy plan
• privacy impact assessments
• system of records notices
• other relevant documents or records

Interview

• Organizational personnel with configuration change control responsibilities
• organizational personnel with information security and privacy responsibilities
• system/network administrators
• members of change control board or similar

Test

• Organizational processes for configuration change control
• mechanisms that implement configuration change control

Assessment Objective

Determine if:

• CM-03(01)(a) [Assignment: automated mechanisms] are used to document proposed changes to the system;
• CM-03(01)(b) [Assignment: automated mechanisms] are used to notify [Assignment: approval authorities] of proposed changes to the system and request change approval;
• CM-03(01)(c) [Assignment: automated mechanisms] are used to highlight proposed changes to the system that have not been approved or disapproved within [Assignment: time period];
• CM-03(01)(d) [Assignment: automated mechanisms] are used to prohibit changes to the system until designated approvals are received;
• CM-03(01)(e) [Assignment: automated mechanisms] are used to document all changes to the system;
• CM-03(01)(f) [Assignment: automated mechanisms] are used to notify [Assignment: personnel] when approved changes to the system are completed.

Assessment Methods

Examine

• Configuration management policy
• procedures addressing system configuration change control
• configuration management plan
• system design documentation
• system architecture and configuration documentation
• automated configuration control mechanisms
• system configuration settings and associated documentation
• change control records
• system audit records
• change approval requests
• change approvals
• system security plan
• other relevant documents or records

Interview

• Organizational personnel with configuration change control responsibilities
• organizational personnel with information security responsibilities
• system/network administrators
• system developers
• members of change control board or similar

Test

• Organizational processes for configuration change control
• automated mechanisms implementing configuration change control activities

Assessment Objective

Determine if:

• CM-03(02)[01] changes to the system are tested before finalizing the implementation of the changes;
• CM-03(02)[02] changes to the system are validated before finalizing the implementation of the changes;
• CM-03(02)[03] changes to the system are documented before finalizing the implementation of the changes.

Assessment Methods

Examine

• Configuration management policy
• configuration management plan
• procedures addressing system configuration change control
• system design documentation
• system architecture and configuration documentation
• system configuration settings and associated documentation
• test records
• validation records
• change control records
• system audit records
• system security plan
• other relevant documents or records

Interview

• Organizational personnel with configuration change control responsibilities
• organizational personnel with information security responsibilities
• system/network administrators
• system developers
• members of change control board or similar

Test

• Organizational processes for configuration change control
• mechanisms supporting and/or implementing, testing, validating, and documenting system changes

Assessment Objective

Determine if:

• CM-03(03)[01] changes to the current system baseline are implemented using [Assignment: automated mechanisms];
• CM-03(03)[02] the updated baseline is deployed across the installed base using [Assignment: automated mechanisms].

Assessment Methods

Examine

• Configuration management policy
• configuration management plan
• procedures addressing system configuration change control
• system design documentation
• system architecture and configuration documentation
• automated configuration control mechanisms
• change control records
• system component inventory
• system audit records
• system security plan
• other relevant documents or records

Interview

• Organizational personnel with configuration change control responsibilities
• organizational personnel with information security responsibilities
• system/network administrators
• system developers
• members of change control board or similar

Test

• Organizational processes for configuration change control
• automated mechanisms implementing changes to current system baseline

Assessment Objective

Determine if:

• CM-03(04)[01] [Assignment: security representatives] are required to be members of the [Assignment: configuration change control element];
• CM-03(04)[02] [Assignment: privacy representatives] are required to be members of the [Assignment: configuration change control element].

Assessment Methods

Examine

• Configuration management policy
• procedures addressing system configuration change control
• configuration management plan
• system security plan
• privacy plan
• other relevant documents or records

Interview

• Organizational personnel with configuration change control responsibilities
• organizational personnel with information security and privacy responsibilities
• members of change control board or similar

Test

• Organizational processes for configuration change control

Assessment Objective

Determine if:

• CM-03(05) [Assignment: security responses] are automatically implemented if baseline configurations are changed in an unauthorized manner.

Assessment Methods

Examine

• System security plan
• configuration management policy
• procedures addressing system configuration change control
• configuration management plan
• system design documentation
• system architecture and configuration documentation
• system configuration settings and associated documentation
• alerts/notifications of unauthorized baseline configuration changes
• system audit records
• other relevant documents or records

Interview

• Organizational personnel with configuration change control responsibilities
• organizational personnel with information security responsibilities
• system/network administrators
• system developers
• members of change control board or similar

Test

• Organizational processes for configuration change control
• automated mechanisms implementing security responses to unauthorized changes to the baseline configurations

Assessment Objective

Determine if:

• CM-03(06) cryptographic mechanisms used to provide [Assignment: controls] are under configuration management.

Assessment Methods

Examine

• Configuration management policy
• procedures addressing system configuration change control
• configuration management plan
• system design documentation
• system architecture and configuration documentation
• system configuration settings and associated documentation
• system security plan
• other relevant documents or records

Interview

• Organizational personnel with configuration change control responsibilities
• organizational personnel with information security responsibilities
• system/network administrators
• system developers
• members of change control board or similar

Test

• Organizational processes for configuration change control
• cryptographic mechanisms implementing organizational security safeguards (controls)

Assessment Objective

Determine if:

• CM-03(07) changes to the system are reviewed [Assignment: frequency] or when [Assignment: circumstances] to determine whether unauthorized changes have occurred.

Assessment Methods

Examine

• Configuration management policy
• procedures addressing system configuration change control
• configuration management plan
• change control records
• system architecture and configuration documentation
• system configuration settings and associated documentation
• system audit records
• system component inventory
• system security plan
• other relevant documents or records

Interview

• Organizational personnel with configuration change control responsibilities
• organizational personnel with security responsibilities
• system/network administrators
• members of change control board or similar

Test

• Organizational processes for configuration change control
• mechanisms implementing audit records for changes

Assessment Objective

Determine if:

• CM-03(08) changes to the configuration of the system are prevented or restricted under [Assignment: circumstances].

Assessment Methods

Examine

• Configuration management policy
• procedures addressing system configuration change control
• configuration management plan
• change control records
• system architecture and configuration documentation
• system configuration settings and associated documentation
• system component inventory
• system audit records
• system security plan
• other relevant documents or records

Assessment Objective

Determine if:

• CM-04[01] changes to the system are analyzed to determine potential security impacts prior to change implementation;
• CM-04[02] changes to the system are analyzed to determine potential privacy impacts prior to change implementation.

Assessment Methods

Examine

• Configuration management policy
• procedures addressing security impact analyses for changes to the system
• procedures addressing privacy impact analyses for changes to the system
• configuration management plan
• security impact analysis documentation
• privacy impact analysis documentation
• privacy impact assessment
• privacy risk assessment documentation, system design documentation
• analysis tools and associated outputs
• change control records
• system audit records
• system security plan
• privacy plan
• other relevant documents or records

Interview

• Organizational personnel with responsibility for conducting security impact analyses
• organizational personnel with responsibility for conducting privacy impact analyses
• organizational personnel with information security and privacy responsibilities
• system developer
• system/network administrators
• members of change control board or similar

Test

• Organizational processes for security impact analyses
• organizational processes for privacy impact analyses

Assessment Objective

Determine if:

• CM-04(01)[01] changes to the system are analyzed in a separate test environment before implementation in an operational environment;
• CM-04(01)[02] changes to the system are analyzed for security impacts due to flaws;
• CM-04(01)[03] changes to the system are analyzed for privacy impacts due to flaws;
• CM-04(01)[04] changes to the system are analyzed for security impacts due to weaknesses;
• CM-04(01)[05] changes to the system are analyzed for privacy impacts due to weaknesses;
• CM-04(01)[06] changes to the system are analyzed for security impacts due to incompatibility;
• CM-04(01)[07] changes to the system are analyzed for privacy impacts due to incompatibility;
• CM-04(01)[08] changes to the system are analyzed for security impacts due to intentional malice;
• CM-04(01)[09] changes to the system are analyzed for privacy impacts due to intentional malice.