Assessment Objective
Determine if:
- CA-09(01)[01] security compliance checks are performed on constituent system components prior to the establishment of the internal connection;
- CA-09(01)[02] privacy compliance checks are performed on constituent system components prior to the establishment of the internal connection.
Assessment Methods
Examine
- Assessment, authorization, and monitoring policy
- access control policy
- procedures addressing system connections
- system and communications protection policy
- system design documentation
- system configuration settings and associated documentation
- list of components or classes of components authorized as internal system connections
- assessment report
- system audit records
- system security plan
- privacy plan
- other relevant documents or records
Interview
- Organizational personnel with responsibilities for developing, implementing, or authorizing internal system connections
- organizational personnel with information security and privacy responsibilities
Test
- Mechanisms supporting compliance checks
Linked Issues
| Linktype | Issue |
|---|---|
| blocks | CA-09(01) Compliance Checks |