Assessment Objective
Determine if:
- usage restrictions are established for mobile devices.
- configuration requirements are established for mobile devices.
- connection requirements are established for mobile devices.
- the connection of mobile devices to the system is authorized.
- full-device or container-based encryption is implemented to protect the confidentiality of CUI on mobile devices.
Assessment Methods
Examine
- access control policy and procedures
- procedures for mobile device access control
- system design documentation
- configuration management plan
- system configuration settings
- authorizations for mobile device connections to organizational systems
- system audit records
- encryption mechanisms and associated configuration documentation
- system security plan
- other relevant documents or records
Interview
- personnel with access control responsibilities for mobile devices
- personnel using mobile devices to access organizational systems
- personnel with information security responsibilities
- system administrators
Test
- access control capability for mobile device connections to organizational systems
- encryption mechanisms for protecting the confidentiality of CUI on mobile devices
- configurations of mobile devices
Kapcsolt feladatok
| Kapcsolattípus | Feladat |
|---|---|
| blocks | 03.01.18 Access Control for Mobile Devices |