Assessment Objective

Determine if:

• CM-10a. software and associated documentation are used in accordance with contract agreements and copyright laws;
• CM-10b. the use of software and associated documentation protected by quantity licenses is tracked to control copying and distribution;
• CM-10c. the use of peer-to-peer file sharing technology is controlled and documented to ensure that peer-to-peer file sharing is not used for the unauthorized distribution, display, performance, or reproduction of copyrighted work.

Assessment Methods

Examine

• Configuration management policy
• software usage restrictions
• software contract agreements and copyright laws
• site license documentation
• list of software usage restrictions
• software license tracking reports
• configuration management plan
• system security plan
• system security plan
• other relevant documents or records

Interview

• Organizational personnel operating, using, and/or maintaining the system
• organizational personnel with software license management responsibilities
• organizational personnel with information security responsibilities
• system/network administrators

Test

• Organizational processes for tracking the use of software protected by quantity licenses
• organizational processes for controlling/documenting the use of peer-to-peer file sharing technology
• mechanisms implementing software license tracking
• mechanisms implementing and controlling the use of peer-to-peer files sharing technology

Tickets liés

• NIST -

  https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final