Assessment Objective

Determine if:

• SC-37 [Assignment: out-of-band channels] are employed for the physical delivery or electronic transmission of [Assignment: information, system components, or devices] to [Assignment: individuals or systems].

Assessment Methods

Examine

• System and communications protection policy
• procedures addressing the use of out-of-band channels
• access control policy and procedures
• identification and authentication policy and procedures
• system design documentation
• system architecture
• system configuration settings and associated documentation
• list of out-of-band channels
• types of information, system components, or devices requiring the use of out-of-band channels for physical delivery or electronic transmission to authorized individuals or systems
• physical delivery records
• electronic transmission records
• system audit records
• system security plan
• other relevant documents or records

Interview

• System/network administrators
• organizational personnel with information security responsibilities
• organizational personnel installing, configuring, and/or maintaining the system
• organizational personnel authorizing, installing, configuring, operating, and/or using out-of-band channels
• system developers/integrators

Test

• Organizational processes for the use of out-of-band channels
• mechanisms supporting and/or implementing the use of out-of-band channels

Linked Issues

• NIST -

  https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final