Assessment Objectives

In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that:

• IAC-25_A01 approved authorizations for logical access to information and system resources are enforced in accordance with applicable access control policies.
  Assessment rigor: 1
  Origin: 53A_R5_AC-03
• IAC-25_A02 the principle of least privilege is employed, allowing only authorized access for users (or processes acting on behalf of users) that are necessary to accomplish assigned organizational tasks.
  Assessment rigor: 1
  Origin: 53A_R5_AC-06
• IAC-25_A03 authorized users are identified.
  Assessment rigor: 1
  Origin: 171A_3.1.1[a]
• IAC-25_A04 processes acting on behalf of authorized users are identified.
  Assessment rigor: 1
  Origin: 171A_3.1.1[b]
• IAC-25_A05 devices (including other systems) authorized to connect to the system are identified.
  Assessment rigor: 1
  Origin: 171A_3.1.1[c]
• IAC-25_A06 system access is limited to authorized users.
  Assessment rigor: 1
  Origin: 171A_3.1.1[d]
• IAC-25_A07 system access is limited to processes acting on behalf of authorized users.
  Assessment rigor: 1
  Origin: 171A_3.1.1[e]
• IAC-25_A08 system access is limited to authorized devices (including other systems).
  Assessment rigor: 1
  Origin: 171A_3.1.1[f]
• IAC-25_A09 systems and system components included in the scope of the specified enhanced security requirements are identified.
  Assessment rigor: 3
  Origin: 172A_3.14.3e_ODP[1]
• IAC-25_A10 systems and system components are included in the scope of the specified enhanced security requirements.
  Assessment rigor: 3
  Origin: 172A_3.14.3e[a]
• IAC-25_A11 systems and system components that are not included in systems and system components are segregated in purpose-specific networks.
  Assessment rigor: 3
  Origin: 172A_3.14.3e[b]

Kapcsolt feladatok

• Secure Controls Framework -

  EN: GRCA includes the Secure Controls Framework® (SCF) content, © Secure Controls Framework Council, LLC, used under the Creative Commons Attribution-NoDerivatives 4.0 International Public License. SCF control numbers, names, descriptions and mappings appear exactly as published by the SCF Council – https://securecontrolsframework.com. GRCA may group or reorder SCF content for display, which does not change SCF content; the mappings are shown as links to the frameworks they name. Learn more at https://securecontrolsframework.com.

  DE: GRCA enthält Inhalte des Secure Controls Framework® (SCF), © Secure Controls Framework Council, LLC, genutzt unter der Creative Commons Attribution-NoDerivatives 4.0 International Public License. Nummern, Namen, Beschreibungen und Zuordnungen der SCF-Controls erscheinen genau so, wie der SCF Council sie veröffentlicht – https://securecontrolsframework.com. GRCA gruppiert oder sortiert SCF-Inhalte für die Anzeige, ohne sie zu verändern; die Zuordnungen erscheinen als Verknüpfungen zu den genannten Regelwerken. Mehr unter https://securecontrolsframework.com.