03.13.13E Port and Input/Output Device Access

Statement

{{ insert: param, A.03.13.13E.ODP.01 }} disable or remove {{ insert: param, A.03.13.13E.ODP.02 }} on the following systems or system components: {{ insert: param, A.03.13.13E.ODP.03 }}.

Guidance

Connection ports include Universal Serial Bus (USB), Thunderbolt, and Firewire (IEEE 1394). Input/output (I/O) devices include optical drives (e.g., compact disc and digital versatile disc drives), printers, and network attached storage devices. Disabling or removing such connection ports and I/O devices helps prevent the exfiltration of information from systems and the introduction of malicious code from those ports or devices. Physically disabling or removing ports and/or devices is the stronger action. This requirement does not enhance a specific requirement in SP 800-171 but can be used to strengthen the protection of CUI associated with critical programs or high value assets.

Statement

• (includes preempt) Ensure that the threat event does not have an impact.

  • Reduce likelihood of occurrence and/or reduce likelihood of impact.

  • The adversary’s efforts or resources cannot be applied or are wasted.

• (includes contain) Make it more difficult for threat events to cause adverse impacts or consequences.

  • Reduce likelihood of impact and reduce level of impact.

  • Adversary activities are restricted in scope, fail to achieve full effect, do not take place in accordance with adversary timeline, or require greater resources than adversary had planned.

Assessment objective

{{ insert: param, A.03.13.13E.ODP.01 }} are {{ insert: param, A.03.13.13E.ODP.02 }} disabled or removed on {{ insert: param, A.03.13.13E.ODP.03 }}.

Assessment method

• System and communications protection policy access control policy and procedures procedures addressing port and input/output device access system design documentation system architecture system configuration settings and associated documentation systems or system components list of connection ports or input/output devices to be physically disabled or removed on systems or system components system security plan other relevant documents or records

Assessment method

• System/network administrators personnel with information security responsibilities personnel installing, configuring, and/or maintaining the system

Assessment method

• Mechanisms supporting and/or implementing the disabling of connection ports or input/output devices

1. Overview

1.1 References

1.2 Identified Requirements

1.3 Related Regulations

2. Identified Requirements

3. Related Regulations

Linked Issues

• NIST -

  https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final