Assessment Objective
Determine if:
- AC-20a.
- AC-20a.01 [Selection (one or more): establish [Assignment: terms and conditions] ; identify [Assignment: controls asserted] ] is/are consistent with the trust relationships established with other organizations owning, operating, and/or maintaining external systems, allowing authorized individuals to access the system from external systems (if applicable);
- AC-20a.02 [Selection (one or more): establish [Assignment: terms and conditions] ; identify [Assignment: controls asserted] ] is/are consistent with the trust relationships established with other organizations owning, operating, and/or maintaining external systems, allowing authorized individuals to process, store, or transmit organization-controlled information using external systems (if applicable);
- AC-20b. the use of [Assignment: prohibited types of external systems] is prohibited (if applicable).
Assessment Methods
Examine
- Access control policy
- procedures addressing the use of external systems
- external systems terms and conditions
- list of types of applications accessible from external systems
- maximum security categorization for information processed, stored, or transmitted on external systems
- system configuration settings and associated documentation
- system security plan
- other relevant documents or records
Interview
- Organizational personnel with responsibilities for defining terms and conditions for use of external systems to access organizational systems
- system/network administrators
- organizational personnel with information security responsibilities
Test
- Mechanisms implementing terms and conditions on the use of external systems
Linkede sager
| Linktype | Sag |
|---|---|
| blocks | AC-20 Use of External Systems |