+CA-03(06) Transfer Authorizations
|
CA-03(06) Transfer Authorizations
Control
Verify that individuals or systems transferring data between interconnecting systems have the requisite authorizations (i.e., write permissions or privileges) prior to accepting such data.
Discussion
To prevent unauthorized individuals and systems from making information transfers to protected systems, the protected system verifies—via independent means— whether the individual or system attempting to transfer information is authorized to do so. Verification of the authorization to transfer information also applies to control plane traffic (e.g., routing and DNS) and services (e.g., authenticated SMTP relays).
Assessment Objective
individuals or systems transferring data between interconnecting systems have the requisite authorizations (i.e., write permissions or privileges) prior to accepting such data.
Assessment Method
Examine
Access control policy
procedures addressing system connections
system and communications protection policy
system interconnection agreements
information exchange security agreements
memoranda of understanding or agreements
service level agreements
non-disclosure agreements
system design documentation
system configuration settings and associated documentation
control assessment report
system audit records
system security plan
privacy plan
other relevant documents or records
Interview
Organizational personnel with responsibilities for managing connections to external systems
network administrators
organizational personnel with information security and privacy responsibilities
1. Panoramica
1.1 Riferimenti
1.2 Requisiti identificati
1.3 Regolamentazioni correlate
2. Requisiti identificati
Requisiti
| Fonte |
Requisito |
3. Regolamentazioni correlate
Regolamentazioni
| Fonte |
Regolamentazione |
Ticket collegati
|