Assessment Objectives
In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that:
- NET-03_A01 the external system boundary is defined.
Assessment rigor: 1
Origin: 171A_3.13.1[a] - NET-03_A02 key internal system boundaries are defined.
Assessment rigor: 1
Origin: 171A_3.13.1[b] - NET-03_A03 communications are protected at the external system boundary.
Assessment rigor: 1
Origin: 171A_3.13.1[g] - NET-03_A04 communications are protected at key internal boundaries.
Assessment rigor: 1
Origin: 171A_3.13.1[h] - NET-03_A05 communications are monitored at the external system boundary.
Assessment rigor: 1
Origin: 53A_R5_SC-07_ODP 53A_R5_SC-07a.[01] 171A_3.13.1[c] - NET-03_A06 communications are controlled at the external system boundary.
Assessment rigor: 1
Origin: 53A_R5_SC-07_ODP 53A_R5_SC-07a.[02] 171A_3.13.1[e] - NET-03_A07 communications are monitored at key internal boundaries.
Assessment rigor: 1
Origin: 53A_R5_SC-07a.[03] 171A_3.13.1[d] - NET-03_A08 communications are controlled at key internal boundaries.
Assessment rigor: 1
Origin: 53A_R5_SC-07a.[04] 171A_3.13.1[f] - NET-03_A09 subnetworks for publicly accessible system components are selected per organization-defined values separated from internal organizational networks.
Assessment rigor: 3
Origin: 53A_R5_SC-07b. - NET-03_A10 external networks or systems are only connected to through managed interfaces consisting of boundary protection devices arranged in accordance with an organizational cybersecurity / data privacy architecture.
Assessment rigor: 3
Origin: 53A_R5_SC-07c. - NET-03_A11 outgoing communications traffic posing a threat to external systems is detected.
Assessment rigor: 3
Origin: 53A_R5_SC-07(09)(a)[01] - NET-03_A12 outgoing communications traffic posing a threat to external systems is denied.
Assessment rigor: 3
Origin: 53A_R5_SC-07(09)(a)[02] - NET-03_A13 the identity of internal users associated with denied communications is audited.
Assessment rigor: 3
Origin: 53A_R5_SC-07(09)(b) - NET-03_A14 authorized sources of incoming communications to be routed are defined.
Assessment rigor: 3
Origin: 53A_R5_SC-07(11)_ODP[01] - NET-03_A15 authorized destinations to which incoming communications from authorized sources may be routed are defined.
Assessment rigor: 3
Origin: 53A_R5_SC-07(11)_ODP[02] - NET-03_A16 only incoming communications from authorized sources are allowed to be routed to authorized destinations.
Assessment rigor: 3
Origin: 53A_R5_SC-07(11) - NET-03_A17 one or more of the following is/are selected: physical isolation techniques. logical isolation techniques.
Assessment rigor: 3
Origin: 172A_3.13.4e_ODP[1] - NET-03_A18 physical isolation techniques are defined.
Assessment rigor: 3
Origin: 172A_3.13.4e_ODP[2] - NET-03_A19 logical isolation techniques are defined.
Assessment rigor: 3
Origin: 172A_3.13.4e_ODP[3] - NET-03_A20 physical isolation techniques and/or organization-defined logical isolation techniques are employed in organizational systems and system components.
Assessment rigor: 3
Origin: 172A_3.13.4e[a] - NET-03_A21 connection requirements are established for mobile devices.
Assessment rigor: 2
Origin: 171A_R3_A.03.01.18.a[03] - NET-03_A22 external system connections are only made through managed interfaces that consist of boundary protection devices arranged in accordance with an organizational security architecture.
Assessment rigor: 2
Origin: 171A_R3_A.03.13.01.c - NET-03_A23 communications at external managed interfaces to the system are controlled.
Assessment rigor: 2
Origin: 171A_R3_A.03.13.01.a[02] - NET-03_A24 communications at key internal managed interfaces within the system are controlled.
Assessment rigor: 2
Origin: 171A_R3_A.03.13.01.a[04]
Linked Issues
| Linktype | Issue |
|---|---|
| blocks | Boundary Protection |
- Secure Controls Framework -
EN: GRCA includes the Secure Controls Framework® (SCF) content, © Secure Controls Framework Council, LLC, used under the Creative Commons Attribution-NoDerivatives 4.0 International Public License. SCF control numbers, names, descriptions and mappings appear exactly as published by the SCF Council – https://securecontrolsframework.com. GRCA may group or reorder SCF content for display, which does not change SCF content; the mappings are shown as links to the frameworks they name. Learn more at https://securecontrolsframework.com.
DE: GRCA enthält Inhalte des Secure Controls Framework® (SCF), © Secure Controls Framework Council, LLC, genutzt unter der Creative Commons Attribution-NoDerivatives 4.0 International Public License. Nummern, Namen, Beschreibungen und Zuordnungen der SCF-Controls erscheinen genau so, wie der SCF Council sie veröffentlicht – https://securecontrolsframework.com. GRCA gruppiert oder sortiert SCF-Inhalte für die Anzeige, ohne sie zu verändern; die Zuordnungen erscheinen als Verknüpfungen zu den genannten Regelwerken. Mehr unter https://securecontrolsframework.com.