Assessment Objective
Determine if:
- SC-03(02)[01] security functions enforcing access control are isolated from non-security functions;
- SC-03(02)[02] security functions enforcing access control are isolated from other security functions;
- SC-03(02)[03] security functions enforcing information flow control are isolated from non-security functions;
- SC-03(02)[04] security functions enforcing information flow control are isolated from other security functions.
Assessment Methods
Examine
- System and communications protection policy
- procedures addressing security function isolation
- list of critical security functions
- system design documentation
- system configuration settings and associated documentation
- system audit records system security plan
- other relevant documents or records
Interview
- System/network administrators
- organizational personnel with information security responsibilities
- system developer
Test
- Isolation of security functions enforcing access and information flow control
Συνδεδεμένα ζητήματα
| Τύπος σύνδεσης | Ζήτημα |
|---|---|
| blocks | SC-03(02) Access and Flow Control Functions |