Assessment Objective
Determine if:
- MP-07a. the use of [Assignment: types of system media] is [Selection: restrict; prohibit] on [Assignment: systems or system components] using [Assignment: controls];
- MP-07b. the use of portable storage devices in organizational systems is prohibited when such devices have no identifiable owner.
Assessment Methods
Examine
- System media protection policy
- system use policy
- procedures addressing media usage restrictions
- rules of behavior
- system design documentation
- system configuration settings and associated documentation
- audit records
- system security plan
- other relevant documents or records
Interview
- Organizational personnel with system media use responsibilities
- organizational personnel with information security responsibilities
- system/network administrators
Test
- Organizational processes for media use
- mechanisms restricting or prohibiting the use of system media on systems or system components
Linked Issues
| Linktype | Issue |
|---|---|
| blocks | MP-07 [L] Media Use |