Assessment Objective
Determine if:
- CA-03(06) individuals or systems transferring data between interconnecting systems have the requisite authorizations (i.e., write permissions or privileges) prior to accepting such data.
Assessment Methods
Examine
- Access control policy
- procedures addressing system connections
- system and communications protection policy
- system interconnection agreements
- information exchange security agreements
- memoranda of understanding or agreements
- service level agreements
- non-disclosure agreements
- system design documentation
- system configuration settings and associated documentation
- control assessment report
- system audit records
- system security plan
- privacy plan
- other relevant documents or records
Interview
- Organizational personnel with responsibilities for managing connections to external systems
- network administrators
- organizational personnel with information security and privacy responsibilities
Test
- Mechanisms implementing restrictions on external system connections
Linked Issues
| Linktype | Issue |
|---|---|
| blocks | CA-03(06) Transfer Authorizations |