03.09.03E Access Agreements

Statement

• Develop and document access agreements for systems processing, storing, or transmitting CUI.

• Review and update the access agreements {{ insert: param, A.03.09.03E_prm_1 }}.

• Verify that individuals requiring access to CUI and systems processing, storing, or transmitting CUI:

  • Sign appropriate access agreements prior to being granted access; and

  • Re-sign access agreements to maintain access to systems when access agreements have been updated or {{ insert: param, A.03.09.03E_prm_1 }}.

Guidance

Access agreements include nondisclosure agreements, acceptable use agreements, rules of behavior, and conflict-of-interest agreements. Signed access agreements include an acknowledgement that individuals have read, understand, and agree to abide by the constraints associated with systems processing, storing, or transmitting CUI to which they have authorized access. This requirement is sourced to a control tailored out of the SP 800-53B .13 moderate baseline in SP 800-171.

Statement

• (includes preempt) Ensure that the threat event does not have an impact.

  • Reduce likelihood of occurrence and/or reduce likelihood of impact.

  • The adversary’s efforts or resources cannot be applied or are wasted.

Assessment objective

access agreements are developed and documented for systems processing, storing, or transmitting CUI.

Assessment objective

access agreements are reviewed {{ insert: param, A.03.09.03E.ODP.01 }}.

Assessment objective

access agreements are updated {{ insert: param, A.03.09.03E.ODP.01 }}.

Assessment objective

individuals requiring access to CUI and systems processing, storing, or transmitting CUI sign appropriate access agreements prior to being granted access.

Assessment objective

individuals requiring access to CUI and systems processing, storing, or transmitting CUI re-sign access agreements to maintain access when access agreements have been updated or {{ insert: param, A.03.09.03E.ODP.02 }}.

Assessment method

• Personnel security policy personnel security procedures procedures addressing access agreements for systems processing, storing, or transmitting CUI access control policy access control procedures access agreements (including non-disclosure agreements, acceptable use agreements, rules of behavior, and conflict-of-interest agreements) documentation of access agreement reviews, updates, and re-signing system security plan other relevant documents or records

Assessment method

• Personnel with personnel security responsibilities personnel who have signed and/or resigned access agreements personnel with information security responsibilities

Assessment method

• Processes for reviewing, updating, and re-signing access agreements mechanisms supporting reviewing, updating, and re-signing of access agreements

1. Panoramica

1.1 Riferimenti

1.2 Requisiti identificati

1.3 Regolamentazioni correlate

2. Requisiti identificati

3. Regolamentazioni correlate

Ticket collegati

• NIST -

  https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final