Assessment Objective

Determine if:

• PL-04(01)(a) the rules of behavior include restrictions on the use of social media, social networking sites, and external sites/applications;
• PL-04(01)(b) the rules of behavior include restrictions on posting organizational information on public websites;
• PL-04(01)(c) the rules of behavior include restrictions on the use of organization-provided identifiers (e.g., email addresses) and authentication secrets (e.g., passwords) for creating accounts on external sites/applications.

Assessment Methods

Examine

• Security and privacy planning policy
• procedures addressing rules of behavior for system users
• rules of behavior
• training policy
• other relevant documents or records

Interview

• Organizational personnel with responsibility for establishing, reviewing, and updating rules of behavior
• organizational personnel with responsibility for literacy training and awareness and role-based training
• organizational personnel who are authorized users of the system and have signed rules of behavior
• organizational personnel with information security and privacy responsibilities

Test

• Organizational processes for establishing rules of behavior
• mechanisms supporting and/or implementing the establishment of rules of behavior

Συνδεδεμένα ζητήματα

• NIST -

  https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final