+AC-04(19) Validation of Metadata
|
AC-04(19) Validation of Metadata
Control
When transferring information between different security domains, implement [Assignement: organization-defined security or privacy policy filters] on metadata.
Discussion
All information (including metadata and the data to which the metadata applies) is subject to filtering and inspection. Some organizations distinguish between metadata and data payloads (i.e., only the data to which the metadata is bound). Other organizations do not make such distinctions and consider metadata and the data to which the metadata applies to be part of the payload.
Assessment Objective
- when transferring information between different security domains, [Assignement: security policy filters] are implemented on metadata;
- when transferring information between different security domains, [Assignement: privacy policy filters] are implemented on metadata.
Assessment Method
Examine
Information flow enforcement policy
information flow control policies
procedures addressing information flow enforcement
system design documentation
system configuration settings and associated documentation
list of security policy filtering criteria applied to metadata and data payloads
system audit records
system security plan
privacy plan
other relevant documents or records
Interview
Organizational personnel with information flow enforcement responsibilities
system/network administrators
organizational personnel with information security responsibilities
organizational personnel with privacy responsibilities
system developers
1. Panoramica
1.1 Riferimenti
1.2 Requisiti identificati
1.3 Regolamentazioni correlate
2. Requisiti identificati
Requisiti
| Fonte |
Requisito |
3. Regolamentazioni correlate
Regolamentazioni
| Fonte |
Regolamentazione |
Ticket collegati
|