Assessment Objective
Determine if:
- SC-28 the [Selection (one or more): confidentiality; integrity] of [Assignment: information at rest] is/are protected.
Assessment Methods
Examine
- System and communications protection policy
- procedures addressing the protection of information at rest
- system design documentation
- system configuration settings and associated documentation
- cryptographic mechanisms and associated configuration documentation
- list of information at rest requiring confidentiality and integrity protections
- system security plan
- other relevant documents or records
Interview
- System/network administrators
- organizational personnel with information security responsibilities
- system developer
Test
- Mechanisms supporting and/or implementing confidentiality and integrity protections for information at rest
Saincheisteanna nasctha
| Cineál naisc | Saincheist |
|---|---|
| blocks | SC-28 [M] Protection of Information at Rest |