Assessment Objective
Determine if:
- SC-42(01) the system is configured so that data or information collected by the [Assignment: sensors] is only reported to authorized individuals or roles.
Assessment Methods
Examine
- System and communications protection policy
- access control policy and procedures
- procedures addressing sensor capability and data collection
- personally identifiable information processing policy
- system design documentation
- system configuration settings and associated documentation
- system architecture
- system audit records
- system security plan
- privacy plan
- other relevant documents or records
Interview
- System/network administrators
- organizational personnel with information security and privacy responsibilities
- system developer
- organizational personnel installing, configuring, and/or maintaining the system
- organizational personnel responsible for the sensor capabilities
Test
- Mechanisms restricting the reporting of sensor information to those authorized
- sensor data collection and reporting capabilities for the system
Verknüpfte Vorgänge
| Verknüpfungstyp | Vorgang |
|---|---|
| blocks | SC-42(01) Reporting to Authorized Individuals or Roles |