Assessment Objective
Determine if:
- AC-04(10)[01] capability is provided for privileged administrators to enable and disable [Assignment: security filters] under [Assignment: conditions];
- AC-04(10)[02] capability is provided for privileged administrators to enable and disable [Assignment: privacy filters] under [Assignment: conditions].
Assessment Methods
Examine
- Access control policy
- information flow information policies
- procedures addressing information flow enforcement
- system design documentation
- system configuration settings and associated documentation
- list of security policy filters enabled/disabled by privileged administrators
- list of privacy policy filters enabled/disabled by privileged administrators
- list of approved data types for enabling/disabling by privileged administrators
- system audit records
- system security plan
- privacy plan
- other relevant documents or records
Interview
- Organizational personnel with responsibilities for enabling/disabling security and privacy policy filters
- system/network administrators
- organizational personnel with information security and privacy responsibilities
- system developers
Test
- Mechanisms implementing information flow enforcement policy
- security and privacy policy filters
Συνδεδεμένα ζητήματα
| Τύπος σύνδεσης | Ζήτημα |
|---|---|
| blocks | AC-04(10) Enable and Disable Security or Privacy Policy Filters |