+AC-20(03) Non-organizationally Owned Systems — Restricted Use
|
AC-20(03) Non-organizationally Owned Systems — Restricted Use
Control
Restrict the use of non-organizationally owned systems or system components to process, store, or transmit organizational information using [Assignement: restrictions].
Discussion
Non-organizationally owned systems or system components include systems or system components owned by other organizations as well as personally owned devices. There are potential risks to using non-organizationally owned systems or components. In some cases, the risk is sufficiently high as to prohibit such use (see [AC-20 b.](#ac-20_smt.b) ). In other cases, the use of such systems or system components may be allowed but restricted in some way. Restrictions include requiring the implementation of approved controls prior to authorizing the connection of non-organizationally owned systems and components; limiting access to types of information, services, or applications; using virtualization techniques to limit processing and storage activities to servers or system components provisioned by the organization; and agreeing to the terms and conditions for usage. Organizations consult with the Office of the General Counsel regarding legal issues associated with using personally owned devices, including requirements for conducting forensic analyses during investigations after an incident.
Assessment Objective
the use of non-organizationally owned systems or system components to process, store, or transmit organizational information is restricted using [Assignement: restrictions].
Assessment Method
Examine
Access control policy
procedures addressing the use of external systems
system design documentation
system configuration settings and associated documentation
system connection or processing agreements
account management documents
system audit records, other relevant documents or records
Interview
Organizational personnel with responsibilities for restricting or prohibiting the use of non-organizationally owned systems, system components, or devices
system/network administrators
organizational personnel with information security responsibilities
1. Übersicht
1.1 Referenzen
1.2 Identifizierte Anforderungen
1.3 Zugehörige Regulierungen
2. Identifizierte Anforderungen
Anforderungen
| Quelle |
Anforderung |
3. Zugehörige Regulierungen
Regulierungen
| Quelle |
Regulierung |
Verknüpfte Vorgänge
|