Assessment Objectives
In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that:
- NET-15_A01 information flows between security domains on connected systems are identified.
Assessment rigor: 1
Origin: 172A_3.1.3e[a] - NET-15_A02 solutions are employed to control information flows between security domains on connected systems.
Assessment rigor: 1
Origin: 172A_3.1.3e[b] - NET-15_A03 cybersecurity / data privacy policy filters to be used as a basis for enforcing information flow control are defined.
Assessment rigor: 1
Origin: 53A_R5_AC-04(08)_ODP[01] 53A_R5_AC-04(08)_ODP[02] - NET-15_A04 information flows for which information flow control is enforced by cybersecurity / data privacy filters are defined.
Assessment rigor: 1
Origin: 53A_R5_AC-04(08)_ODP[03] 53A_R5_AC-04(08)_ODP[04] 172A_3.1.3e_ODP[1] - NET-15_A05 information flow control is enforced using organization-defined cybersecurity / data privacy policy filter as a basis for flow control decisions for organization-defined information flows.
Assessment rigor: 1
Origin: 53A_R5_AC-04(08)(a)[01] 53A_R5_AC-04(08)(a)[02] - NET-15_A06 cybersecurity / data privacy policy identifying actions to be taken after a filter processing failure are defined (e.g., block, strip, modify or quarantine)
Assessment rigor: 3
Origin: 53A_R5_AC-04(08)_ODP[05] 53A_R5_AC-04(08)_ODP[06] - NET-15_A07 policy identifying actions to be taken after a filter processing failure are defined.
Assessment rigor: 3
Origin: 53A_R5_AC-04(08)_ODP[07] - NET-15_A08 organization's data after a filter processing failure in accordance with organization's data after a filter processing failure in accordance with organization-defined privacy policy.
Assessment rigor: 3
Origin: 53A_R5_AC-04(08)(b) - NET-15_A09 when transferring information between different security domains, data is sanitized to minimize organization's in accordance with organization-defined policy.
Assessment rigor: 3
Origin: 53A_R5_AC-04(25)_ODP[01] 53A_R5_AC-04(25)
Verknüpfte Vorgänge
| Verknüpfungstyp | Vorgang |
|---|---|
| blocks | Policy Decision Point (PDP) |
- Secure Controls Framework -
EN: GRCA includes the Secure Controls Framework® (SCF) content, © Secure Controls Framework Council, LLC, used under the Creative Commons Attribution-NoDerivatives 4.0 International Public License. SCF control numbers, names, descriptions and mappings appear exactly as published by the SCF Council – https://securecontrolsframework.com. GRCA may group or reorder SCF content for display, which does not change SCF content; the mappings are shown as links to the frameworks they name. Learn more at https://securecontrolsframework.com.
DE: GRCA enthält Inhalte des Secure Controls Framework® (SCF), © Secure Controls Framework Council, LLC, genutzt unter der Creative Commons Attribution-NoDerivatives 4.0 International Public License. Nummern, Namen, Beschreibungen und Zuordnungen der SCF-Controls erscheinen genau so, wie der SCF Council sie veröffentlicht – https://securecontrolsframework.com. GRCA gruppiert oder sortiert SCF-Inhalte für die Anzeige, ohne sie zu verändern; die Zuordnungen erscheinen als Verknüpfungen zu den genannten Regelwerken. Mehr unter https://securecontrolsframework.com.