Assessment Objective
Determine if:
- CA-03(07)(a) transitive (downstream) information exchanges with other systems through the systems identified in CA-03a are identified;
- CA-03(07)(b) measures are taken to ensure that transitive (downstream) information exchanges cease when the controls on identified transitive (downstream) systems cannot be verified or validated.
Assessment Methods
Examine
- Access control policy
- procedures addressing system connections
- system and communications protection policy
- system interconnection agreements
- information exchange security agreements
- memoranda of understanding or agreements
- service level agreements
- non-disclosure agreements
- system design documentation
- system configuration settings and associated documentation
- control assessment report
- system audit records
- system security plan
- privacy plan
- other relevant documents or records
Interview
- Organizational personnel with responsibilities for managing connections to external systems
- network administrators
- organizational personnel with information security and privacy responsibilities
Test
- Mechanisms implementing restrictions on external system connections
Verknüpfte Vorgänge
| Verknüpfungstyp | Vorgang |
|---|---|
| blocks | CA-03(07) Transitive Information Exchanges |