Assessment Objective
Determine if:
- AC-20(02) the use of organization-controlled portable storage devices by authorized individuals is restricted on external systems using [Assignment: restrictions].
Assessment Methods
Examine
- Access control policy
- procedures addressing the use of external systems
- system configuration settings and associated documentation
- system connection or processing agreements
- account management documents
- system security plan
- other relevant documents or records
Interview
- Organizational personnel with responsibilities for restricting or prohibiting the use of organization-controlled storage devices on external systems
- system/network administrators
- organizational personnel with information security responsibilities
Test
- Mechanisms implementing restrictions on the use of portable storage devices
Verknüpfte Vorgänge
| Verknüpfungstyp | Vorgang |
|---|---|
| blocks | AC-20(02) Portable Storage Devices — Restricted Use |