Assessment Objective
Determine if:
- CA-09a. internal connections of [Assignment: system components] to the system are authorized;
- CA-09b.
- CA-09b.[01] for each internal connection, the interface characteristics are documented;
- CA-09b.[02] for each internal connection, the security requirements are documented;
- CA-09b.[03] for each internal connection, the privacy requirements are documented;
- CA-09b.[04] for each internal connection, the nature of the information communicated is documented;
- CA-09c. internal system connections are terminated after [Assignment: conditions];
- CA-09d. the continued need for each internal connection is reviewed [Assignment: frequency].
Assessment Methods
Examine
- Assessment, authorization, and monitoring policy
- access control policy
- procedures addressing system connections
- system and communications protection policy
- system design documentation
- system configuration settings and associated documentation
- list of components or classes of components authorized as internal system connections
- assessment report
- system audit records
- system security plan
- privacy plan
- other relevant documents or records
Interview
- Organizational personnel with responsibilities for developing, implementing, or authorizing internal system connections
- organizational personnel with information security and privacy responsibilities
Test
- Mechanisms supporting internal system connections
Linked Issues
| Linktype | Issue |
|---|---|
| blocks | CA-09 [M] Internal System Connections |