Assessment Objective
Determine if:
- AC-20(03) the use of non-organizationally owned systems or system components to process, store, or transmit organizational information is restricted using [Assignment: restrictions].
Assessment Methods
Examine
- Access control policy
- procedures addressing the use of external systems
- system design documentation
- system configuration settings and associated documentation
- system connection or processing agreements
- account management documents
- system audit records, other relevant documents or records
Interview
- Organizational personnel with responsibilities for restricting or prohibiting the use of non-organizationally owned systems, system components, or devices
- system/network administrators
- organizational personnel with information security responsibilities
Test
- Mechanisms implementing restrictions on the use of non-organizationally owned systems, components, or devices
Incidencias vinculadas
| Tipo de vínculo | Incidencia |
|---|---|
| blocks | AC-20(03) Non-organizationally Owned Systems — Restricted Use |