Assessment Objective
Determine if:
- CM-08(03)(a)
- CM-08(03)(a)[01] the presence of unauthorized hardware within the system is detected using [Assignment: automated mechanisms] [Assignment: frequency];
- CM-08(03)(a)[02] the presence of unauthorized software within the system is detected using [Assignment: automated mechanisms] [Assignment: frequency];
- CM-08(03)(a)[03] the presence of unauthorized firmware within the system is detected using [Assignment: automated mechanisms] [Assignment: frequency];
- CM-08(03)(b)
- CM-08(03)(b)[01] [Selection (one or more): disable network access by unauthorized components; isolate unauthorized components; notify [Assignment: personnel or roles] ] are taken when unauthorized hardware is detected;
- CM-08(03)(b)[02] [Selection (one or more): disable network access by unauthorized components; isolate unauthorized components; notify [Assignment: personnel or roles] ] are taken when unauthorized software is detected;
- CM-08(03)(b)[03] [Selection (one or more): disable network access by unauthorized components; isolate unauthorized components; notify [Assignment: personnel or roles] ] are taken when unauthorized firmware is detected.
Assessment Methods
Examine
- Configuration management policy
- procedures addressing system component inventory
- configuration management plan
- system design documentation
- system security plan
- system component inventory
- change control records
- alerts/notifications of unauthorized components within the system
- system monitoring records
- system maintenance records
- system audit records
- system security plan
- other relevant documents or records
Interview
- Organizational personnel with component inventory management responsibilities
- organizational personnel with responsibilities for managing the automated mechanisms implementing unauthorized system component detection
- organizational personnel with information security responsibilities
- system/network administrators
- system developers
Test
- Organizational processes for detection of unauthorized system components
- organizational processes for taking action when unauthorized system components are detected
- automated mechanisms supporting and/or implementing the detection of unauthorized system components
- automated mechanisms supporting and/or implementing actions taken when unauthorized system components are detected
Verknüpfte Vorgänge
| Verknüpfungstyp | Vorgang |
|---|---|
| blocks | CM-08(03) Automated Unauthorized Component Detection |