Assessment Objective

Determine if:

• SC-37(01) [Assignment: controls] are employed to ensure that only [Assignment: individuals or systems] receive [Assignment: information, system components, or devices].

Assessment Methods

Examine

• System and communications protection policy
• procedures addressing the use of out-of-band channels
• access control policy and procedures
• identification and authentication policy and procedures
• system design documentation
• system architecture
• system configuration settings and associated documentation
• list of security safeguards to be employed to ensure that designated individuals or systems receive organization-defined information, system components, or devices
• list of security safeguards for delivering designated information, system components, or devices to designated individuals or systems
• list of information, system components, or devices to be delivered to designated individuals or systems
• system audit records
• system security plan
• other relevant documents or records

Interview

• System/network administrators
• organizational personnel with information security responsibilities
• organizational personnel installing, configuring, and/or maintaining the system
• organizational personnel authorizing, installing, configuring, operating, and/or using out-of-band channels
• system developers/integrators

Test

• Organizational processes for the use of out-of-band channels
• mechanisms supporting and/or implementing the use of out-of-band channels
• mechanisms supporting/implementing safeguards to ensure the delivery of designated information, system components, or devices

Saincheisteanna nasctha

• NIST -

  https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final