03.09.03E Access Agreements

Statement

• Develop and document access agreements for systems processing, storing, or transmitting CUI.

• Review and update the access agreements {{ insert: param, A.03.09.03E_prm_1 }}.

• Verify that individuals requiring access to CUI and systems processing, storing, or transmitting CUI:

  • Sign appropriate access agreements prior to being granted access; and

  • Re-sign access agreements to maintain access to systems when access agreements have been updated or {{ insert: param, A.03.09.03E_prm_1 }}.

Guidance

Access agreements include nondisclosure agreements, acceptable use agreements, rules of behavior, and conflict-of-interest agreements. Signed access agreements include an acknowledgement that individuals have read, understand, and agree to abide by the constraints associated with systems processing, storing, or transmitting CUI to which they have authorized access. This requirement is sourced to a control tailored out of the SP 800-53B .13 moderate baseline in SP 800-171.

Statement

• (includes preempt) Ensure that the threat event does not have an impact.

  • Reduce likelihood of occurrence and/or reduce likelihood of impact.

  • The adversary’s efforts or resources cannot be applied or are wasted.

Assessment objective

access agreements are developed and documented for systems processing, storing, or transmitting CUI.

Assessment objective

access agreements are reviewed {{ insert: param, A.03.09.03E.ODP.01 }} .

Assessment objective

access agreements are updated {{ insert: param, A.03.09.03E.ODP.01 }} .

Assessment objective

individuals requiring access to CUI and systems processing, storing, or transmitting CUI sign appropriate access agreements prior to being granted access.

Assessment objective

individuals requiring access to CUI and systems processing, storing, or transmitting CUI re-sign access agreements to maintain access when access agreements have been updated or {{ insert: param, A.03.09.03E.ODP.02 }} .

Assessment method

• Personnel security policy personnel security procedures procedures addressing access agreements for systems processing, storing, or transmitting CUI access control policy access control procedures access agreements (including non-disclosure agreements, acceptable use agreements, rules of behavior, and conflict-of-interest agreements) documentation of access agreement reviews, updates, and re-signing system security plan other relevant documents or records

Assessment method

• Personnel with personnel security responsibilities personnel who have signed and/or resigned access agreements personnel with information security responsibilities

Assessment method

• Processes for reviewing, updating, and re-signing access agreements mechanisms supporting reviewing, updating, and re-signing of access agreements

1. Forbhreathnú

1.1 Tagairtí

1.2 Ceanglais aitheanta

1.3 Rialacháin ghaolmhara

2. Ceanglais aitheanta

3. Rialacháin ghaolmhara

Saincheisteanna nasctha

• NIST -

  EN: Publications of the National Institute of Standards and Technology (NIST), U.S. Department of Commerce, https://www.nist.gov/, from their electronic versions (OSCAL; SP 800-63-4 from its HTML version, https://pages.nist.gov/800-63-4/). Works of NIST employees are not subject to copyright protection in the United States (17 U.S.C. § 105); the OSCAL content is dedicated to the public domain worldwide (CC0 1.0); outside the United States NIST grants the right to reprint its technical series publications in all formats (NIST copyright statement). Republished courtesy of the National Institute of Standards and Technology; each document names its citation. Divided into sections and converted into the GRCA format, the wording unchanged. Only the versions published by NIST are authoritative.

  DE: Veröffentlichungen des National Institute of Standards and Technology (NIST), U.S. Department of Commerce, https://www.nist.gov/, aus ihren elektronischen Fassungen (OSCAL; SP 800-63-4 aus ihrer HTML-Fassung, https://pages.nist.gov/800-63-4/). Werke von NIST-Beschäftigten sind in den USA urheberrechtlich nicht geschützt (17 U.S.C. § 105); die OSCAL-Inhalte sind weltweit gemeinfrei gestellt (CC0 1.0); außerhalb der USA räumt das NIST das Recht ein, seine Technical-Series-Publikationen in allen Formaten neu zu veröffentlichen (Copyright-Hinweis des NIST). „Republished courtesy of the National Institute of Standards and Technology“; jedes Dokument nennt seine Zitierangabe. In Abschnitte aufgeteilt und in das GRCA-Format umgewandelt, der Wortlaut unverändert. Maßgeblich sind allein die vom NIST veröffentlichten Fassungen.