Assessment Objectives
In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that:
- NET-03.2_A01 the frequency at which to review exceptions to traffic flow policy is defined.
Defined parameters: at least every 180 days or whenever there is a change in the threat environment that warrants a review of the exceptions
Assessment rigor: 1
Origin: 53A_R5_SC-07(04)_ODP - NET-03.2_A02 a managed interface is implemented for each external telecommunication service.
Assessment rigor: 1
Origin: 53A_R5_SC-07(04)(a) - NET-03.2_A03 a traffic flow policy is established for each managed interface.
Assessment rigor: 1
Origin: 53A_R5_SC-07(04)(b) - NET-03.2_A04 the confidentiality of the information being transmitted across each interface is protected.
Assessment rigor: 3
Origin: 53A_R5_SC-07(04)(c)[01] - NET-03.2_A05 the integrity of the information being transmitted across each interface is protected.
Assessment rigor: 3
Origin: 53A_R5_SC-07(04)(c)[02] - NET-03.2_A06 each exception to the traffic flow policy is documented with a supporting mission or business need and duration of that need.
Assessment rigor: 3
Origin: 53A_R5_SC-07(04)(d) - NET-03.2_A07 exceptions to the traffic flow policy are reviewed frequently.
Defined parameters: at least every 180 days or whenever there is a change in the threat environment that warrants a review of the exceptions
Assessment rigor: 3
Origin: 53A_R5_SC-07(04)(e)[01] - NET-03.2_A08 exceptions to the traffic flow policy that are no longer supported by an explicit mission or business need are removed.
Assessment rigor: 3
Origin: 53A_R5_SC-07(04)(e)[02] - NET-03.2_A09 unauthorized exchanges of control plan traffic with external networks are prevented.
Assessment rigor: 3
Origin: 53A_R5_SC-07(04)(f) - NET-03.2_A10 information is published to enable remote networks to detect unauthorized control plane traffic from internal networks.
Assessment rigor: 3
Origin: 53A_R5_SC-07(04)(g) - NET-03.2_A11 unauthorized control plane traffic is filtered from external networks.
Assessment rigor: 3
Origin: 53A_R5_SC-07(04)(h) - NET-03.2_A12 outgoing communications traffic posing a threat to external systems is detected.
Assessment rigor: 3
Origin: 53A_R5_SC-07(09)(a)[01] - NET-03.2_A13 outgoing communications traffic posing a threat to external systems is denied.
Assessment rigor: 3
Origin: 53A_R5_SC-07(09)(a)[02] - NET-03.2_A14 the identity of internal users associated with denied communications is audited.
Assessment rigor: 3
Origin: 53A_R5_SC-07(09)(b)
Saincheisteanna nasctha
| Cineál naisc | Saincheist |
|---|---|
| blocks | External Telecommunications Services |
- Secure Controls Framework -
EN: GRCA includes the Secure Controls Framework® (SCF) content, © Secure Controls Framework Council, LLC, used under the Creative Commons Attribution-NoDerivatives 4.0 International Public License. SCF control numbers, names, descriptions and mappings appear exactly as published by the SCF Council – https://securecontrolsframework.com. GRCA may group or reorder SCF content for display, which does not change SCF content; the mappings are shown as links to the frameworks they name. Learn more at https://securecontrolsframework.com.
DE: GRCA enthält Inhalte des Secure Controls Framework® (SCF), © Secure Controls Framework Council, LLC, genutzt unter der Creative Commons Attribution-NoDerivatives 4.0 International Public License. Nummern, Namen, Beschreibungen und Zuordnungen der SCF-Controls erscheinen genau so, wie der SCF Council sie veröffentlicht – https://securecontrolsframework.com. GRCA gruppiert oder sortiert SCF-Inhalte für die Anzeige, ohne sie zu verändern; die Zuordnungen erscheinen als Verknüpfungen zu den genannten Regelwerken. Mehr unter https://securecontrolsframework.com.