Assessment Objective
Determine if:
- SA-04(10) only information technology products on the FIPS 201-approved products list for the Personal Identity Verification (PIV) capability implemented within organizational systems are employed.
Assessment Methods
Examine
- Supply chain risk management plan
- system and services acquisition policy
- procedures addressing the integration of security requirements, descriptions, and criteria into the acquisition process
- solicitation documentation
- acquisition documentation
- acquisition contracts for the system, system component, or system service
- service level agreements
- FIPS 201 approved products list
- system security plan
- other relevant documents or records
Interview
- Organizational personnel with acquisition/contracting responsibilities
- organizational personnel with the responsibility for determining system security requirements
- organizational personnel with the responsibility for ensuring that only FIPS 201- approved products are implemented
- organizational personnel with information security responsibilities
Test
- Organizational processes for selecting and employing FIPS 201-approved products
Saincheisteanna nasctha
| Cineál naisc | Saincheist |
|---|---|
| blocks | SA-04(10) [M] Use of Approved PIV Products |