NIST SP 800-172 Rev. 3 – Assessment Procedures

Collegamenti
Titolo	Descrizione
03.01.01E Dual Authorization – Assessment Procedure	Assessment Objective Determine if: dual authorization is enforced for [Assignment: privileged commands and/or other actions]. Assessment Methods Examine Access control policy procedures addressing access enforcement and dual authorization system design documentation system configuration settings and associated documentation list of actions requiring dual authorization list of privileged commands requiring dual authorization list of approved authorizations (user privileges) system security plan other relevant documents or records Interview Personnel with access enforcement responsibilities system/network administrators system developers personnel with information security responsibilities Test Dual authorization mechanisms implementing access control policy
03.01.02E Non-Organizationally Owned Systems - Restricted Use – Assessment Procedure	Assessment Objective Determine if: the use of non-organizationally owned systems or system components to process, store, or transmit CUI is restricted using [Assignment: restrictions]. Assessment Methods Examine Access control policy procedures addressing the use of external systems system design documentation system configuration settings and associated documentation system connection or processing agreements account management documents system audit records other relevant documents or records Interview Personnel with responsibilities for restricting or prohibiting the use of non-organizationally owned systems, system components, or devices system/network administrators personnel with information security responsibilities Test Mechanisms implementing restrictions on the use of non-organizationally owned systems, components, or devices
03.01.04E Concurrent Session Control – Assessment Procedure	Assessment Objective Determine if: the number of concurrent sessions for each [Assignment: account and/or account types] is limited to [Assignment: number]. Assessment Methods Examine Access control policy procedures addressing concurrent session control system design documentation system configuration settings and associated documentation security plan system security plan other relevant documents or records Interview System/network administrators personnel with information security responsibilities system developers Test Mechanisms implementing access control policy for concurrent session control
03.01.05E Remote Access Monitoring and Control – Assessment Procedure	Assessment Objective Determine if: automated mechanisms are employed to monitor remote access methods. automated mechanisms are employed to control remote access methods. Assessment Methods Examine Access control policy procedures addressing remote access to the system system design documentation system configuration settings and associated documentation system audit records system monitoring records system security plan other relevant documents or records Interview System/network administrators personnel with information security responsibilities system developers Test Automated mechanisms monitoring and controlling remote access methods
03.01.06E Protection of Remote Access Mechanism Information – Assessment Procedure	Assessment Objective Determine if: information about remote access mechanisms is protected from unauthorized use and disclosure. Assessment Methods Examine Access control policy procedures addressing remote access to the system system security plan other relevant documents or records Interview Personnel with responsibilities for implementing or monitoring remote access to the system system users with knowledge of information about remote access mechanisms personnel with information security responsibilities
03.01.07E Automated Audit Actions for Account Management – Assessment Procedure	Assessment Objective Determine if: automated mechanisms are used to audit account creation actions. automated mechanisms are used to audit account modification actions. automated mechanisms are used to audit account enabling actions. automated mechanisms are used to audit account disabling actions. automated mechanisms are used to audit account removal actions. Assessment Methods Examine Access control policy procedures addressing account management system design documentation system configuration settings and associated documentation notifications or alerts of account creation, modification, enabling, disabling, and removal actions system audit records system security plan other relevant documents or records Interview Personnel with account management responsibilities system/network administrators personnel with information security responsibilities Test Automated mechanisms implementing account management functions
03.01.08E Account Monitoring for Atypical Usage – Assessment Procedure	Assessment Objective Determine if: system accounts are monitored for [Assignment: atypical usage]. atypical usage of system accounts is reported to [Assignment: personnel or roles]. Assessment Methods Examine Access control policy procedures addressing account management system design documentation system configuration settings and associated documentation system monitoring records system audit records audit tracking and monitoring reports system security plan other relevant documents or records Interview Personnel with account management responsibilities system/network administrators personnel with information security responsibilities Test Mechanisms implementing account management functions
03.01.09E Attribute-Based Access Control – Assessment Procedure	Assessment Objective Determine if: the attribute-based access control policy is enforced over defined subjects. the attribute-based access control policy is enforced over defined objects. access is controlled based upon [Assignment: attributes] . Assessment Methods Examine Access control policy procedures addressing access enforcement system design documentation system configuration settings and associated documentation list of subjects and objects (i.e., users and resources) requiring enforcement of attribute-based access control policies system audit records system security plan other relevant documents or records Interview Personnel with access enforcement responsibilities system/network administrators personnel with information security responsibilities Test Mechanisms implementing access enforcement functions
03.01.10E Object Security Attributes – Assessment Procedure	Assessment Objective Determine if: [Assignment: security attributes] associated with [Assignment: information objects], [Assignment: source objects], and [Assignment: destination objects] are used to enforce [Assignment: information flow control policies] as a basis for flow control decisions. Assessment Methods Examine Access control policy information flow control policies procedures addressing information flow enforcement system design documentation system configuration settings and associated documentation list of security attributes and associated source and destination objects system audit records system security plan other relevant documents or records Interview System/network administrators personnel with information security responsibilities system developers Test Mechanisms implementing information flow enforcement policy
03.01.11E Role-Based Access Control – Assessment Procedure	Assessment Objective Determine if: a role-based access control policy over defined subjects and objects is enforced. access is controlled based upon [Assignment: organization-defined roles and users authorized to assume such roles] . Assessment Methods Examine Access control policy role-based access control policies procedures addressing access enforcement system design documentation system configuration settings and associated documentation list of roles, users, and associated privileges required to control system access system audit records system security plan other relevant documents or records Interview Organizational personnel with access enforcement responsibilities system/network administrators organizational personnel with information security responsibilities system developers Test Mechanisms implementing role-based access control policy
03.01.12E Physical or Logical Separation of CUI Flows – Assessment Procedure	Assessment Objective Determine if: CUI flows are logically or physically separated using [Assignment: organization-defined mechanisms and/or techniques]. Assessment Methods Examine Information flow enforcement policy information flow control policies procedures addressing information flow enforcement system design documentation system configuration settings and associated documentation list of required separation of information flows by information types list of mechanisms and/or techniques used to logically or physically separate information flows system audit records system security plan other relevant documents or records Interview Organizational personnel with information flow enforcement responsibilities system/network administrators organizational personnel with information security responsibilities system developers Test Mechanisms implementing information flow enforcement functions
03.01.13E Metadata – Assessment Procedure	Assessment Objective Determine if: information flow control based on [Assignment: metadata] is enforced. Assessment Methods Examine Access control policy information flow control policies procedures addressing information flow enforcement system design documentation system configuration settings and associated documentation system audit records system security plan other relevant documents or records Interview System/network administrators organizational personnel with information security responsibilities system developers Test Mechanisms implementing information flow enforcement policy
03.01.14E Security Policy Filters – Assessment Procedure	Assessment Objective Determine if: information flow control is enforced using [Assignment: organization-defined security policy filters] as a basis for flow control decisions for [Assignment: organization-defined information flows]. [Assignment: SELECTED PARAMETER VALUE(S)] data after a filter processing failure in accordance with [Assignment: organization-defined security policy]. Assessment Methods Examine Access control policy information flow control policies procedures addressing information flow enforcement system design documentation system configuration settings and associated documentation list of security policy filters regulating flow control decisions system audit records system security plan other relevant documents or records Interview System/network administrators organizational personnel with information security responsibilities system developers Test Mechanisms implementing information flow enforcement policy security policy filters
03.01.15E Data Type Identifiers – Assessment Procedure	Assessment Objective Determine if: when transferring information between security domains, [Assignment: data type identifiers] are used to validate data that is essential for information flow decisions. Assessment Methods Examine Access control policy information flow control policies procedures addressing information flow enforcement system design documentation system configuration settings and associated documentation list of data type identifiers system audit records system security plan other relevant documents or records Interview System/network administrators organizational personnel with information security responsibilities system developers Test Mechanisms implementing information flow enforcement policy
03.01.16E Decomposition Into Policy-Relevant Subcomponents – Assessment Procedure	Assessment Objective Determine if: when transferring information between different security domains, CUI is decomposed into [Assignment: policy-relevant subcomponents] for submission to policy enforcement mechanisms Assessment Methods Examine Access control policy information flow control policies procedures addressing information flow enforcement system design documentation system configuration settings and associated documentation system audit records system security plan other relevant documents or records Interview System/network administrators personnel with information security responsibilities system developers Test Mechanisms implementing information flow enforcement policy
03.01.17E Detection of Unsanctioned CUI – Assessment Procedure	Assessment Objective Determine if: when transferring information between different security domains, information is examined for the presence of [Assignment: organization-defined unsanctioned information] . the transfer of CUI defined in 03.01.17E.a is prohibited in accordance with [Assignment: organization-defined security policy]. Assessment Methods Examine Access control policy information flow control policies procedures addressing information flow enforcement system design documentation system configuration settings and associated documentation list of unsanctioned information types and associated information system audit records system security plan other relevant documents or records Interview Organizational personnel with information security responsibilities system developers Test Mechanisms implementing information flow enforcement policy
03.02.01E Advanced Literacy and Awareness Training – Assessment Procedure	Assessment Objective Determine if: security literacy training on the advanced persistent threat is provided to system users. security literacy training on recognizing suspicious communications and anomalous behavior in systems using [Assignment: indicators of malicious code] is provided to system users. security literacy training on the cyber threat environment is provided to system users. security literacy training content is updated [Assignment: frequency]. security literacy training content is updated following [Assignment: events] Assessment Methods Examine System security plan security literacy and awareness training policy procedures addressing security literacy and awareness training implementation security literacy and awareness training curriculum security literacy and awareness training materials other relevant documents or records Interview Personnel who receive security literacy and awareness training personnel with responsibilities for security literacy and awareness training personnel with information security responsibilities
03.02.02E Literacy and Awareness Training Practical Exercises – Assessment Procedure	Assessment Objective Determine if: practical exercises in literacy training that simulate events and incidents are provided. Assessment Methods Examine System security plan security literacy and awareness training policy procedures addressing security literacy and awareness training implementation security awareness training curriculum security awareness training materials other relevant documents or records Interview Personnel who receive security literacy and awareness training personnel with responsibilities for security awareness training personnel with information security responsibilities Test Mechanisms implementing cyber-attack simulations in practical exercises
03.02.03E Literacy and Awareness Training Feedback – Assessment Procedure	Assessment Objective Determine if: feedback on organizational training results is provided to [Assignment: personnel]. Assessment Methods Examine Security awareness training policy procedures addressing security literacy and awareness training records security literacy and awareness training records security plan other relevant documents or records Interview Personnel with security and awareness training record retention responsibilities Test Mechanisms supporting the management of security literacy and awareness training records
03.02.04E Anti-Counterfeit Training – Assessment Procedure	Assessment Objective Determine if: [Assignment: personnel or roles] are trained to detect counterfeit system components. Assessment Methods Examine Supply chain risk management policy and procedures supply chain risk management plan system and services acquisition policy anti-counterfeit plan anti-counterfeit policy and procedures media disposal policy media protection policy incident response policy training materials addressing counterfeit system components training records on the detection and prevention of counterfeit components entering the system system security plan other relevant documents or records Interview Personnel with information security responsibilities personnel with supply chain risk management responsibilities personnel with contract management responsibilities personnel with personnel with responsibilities for anti-counterfeit policies, procedures, and training Test Processes for anti-counterfeit training
03.03.01E Protection of Audit Record Storage in Separate Physical Systems or Components – Assessment Procedure	Assessment Objective Determine if: audit records are stored in a repository that is part of a physically different system or system component than the system or component being audited. Assessment Methods Examine Audit and accountability policy system security plan procedures addressing protection of audit information system design documentation system configuration settings and associated documentation system or media storing backups of system audit records system audit records other relevant documents or records Interview Personnel with audit and accountability responsibilities personnel with information security responsibilities system/network administrators system developers Test Mechanisms implementing the backing up of audit records
03.03.02E Real-Time Alerts for Audit Processing Failures – Assessment Procedure	Assessment Objective Determine if: an alert is provided within [Assignment: real-time period] to [Assignment: personnel, roles, and/or locations] when [Assignment: audit logging failure events] occur. Assessment Methods Examine Audit and accountability policy procedures addressing response to audit processing failures system design documentation system security plan system configuration settings and associated documentation system audit records other relevant documents or records Interview Personnel with audit and accountability responsibilities personnel with information security responsibilities system/network administrators system developers
03.03.03E Dual Authorization for Audit Information and Actions – Assessment Procedure	Assessment Objective Determine if: dual authorization is enforced for the [Assignment: SELECTED PARAMETER VALUE(S)] of [Assignment: audit information]. Assessment Methods Examine Audit and accountability policy system security plan access control policy and procedures procedures addressing protection of audit information system design documentation system configuration settings and associated documentation access authorizations system audit records other relevant documents or records Interview Personnel with audit and accountability responsibilities personnel with information security responsibilities system/network administrators Test Mechanisms implementing the enforcement of dual authorization
03.03.04E Integrated Analysis of Audit Records – Assessment Procedure	Assessment Objective Determine if: analysis of audit records is integrated with analysis of [Assignment: SELECTED PARAMETER VALUE(S)] to further enhance the ability to identify inappropriate or unusual activity. Assessment Methods Examine Audit and accountability policy system security plan procedures addressing audit review, analysis, and reporting system design documentation system configuration settings and associated documentation integrated analysis of audit records, vulnerability scanning information, performance data, network monitoring information and associated documentation other relevant documents or records Interview Personnel with audit review, analysis, and reporting responsibilities personnel with information security responsibilities Test Mechanisms implementing the capability to integrate analysis of audit records with analysis of data or information sources
03.04.02E Automated Unauthorized Component Detection – Assessment Procedure	Assessment Objective Determine if: the presence of unauthorized or misconfigured system components is detected using [Assignment: automated mechanisms]. one or more of the following actions is/are taken when unauthorized or misconfigured system components are detected: [Assignment: SELECTED PARAMETER VALUE(S)]. Assessment Methods Examine Configuration management policy procedures addressing system component inventory and configuration settings configuration management plan system configuration settings and associated documentation system component inventory system design documentation change control records common secure configuration checklists alerts or notifications of unauthorized components within the system system monitoring records system maintenance records system audit records system security plan other relevant documents or records Interview Personnel with component inventory and security configuration management responsibilities personnel with responsibilities for managing automated mechanisms implementing unauthorized system component detection personnel with information security responsibilities system/network administrators system developers Test Processes for the detection of unauthorized or misconfigured system components automated processes for taking action when unauthorized or misconfigured system components are detected automated mechanisms supporting and/or implementing the detection of unauthorized or misconfigured system components automated mechanisms supporting and/or implementing actions taken when unauthorized or misconfigured system components are detected
03.04.03E Automated Maintenance of System Component Inventory – Assessment Procedure	Assessment Objective Determine if: [Assignment: automated mechanisms] are used to maintain the currency of the system component inventory. [Assignment: automated mechanisms] are used to maintain the completeness of the system component inventory. [Assignment: automated mechanisms] are used to maintain the accuracy of the system component inventory. [Assignment: automated mechanisms] are used to maintain the availability of the system component inventory. Assessment Methods Examine Configuration management policy procedures addressing system component inventory configuration management plan system security plan system design documentation system component inventory change control records system maintenance records system audit records other relevant documents or records Interview Personnel with component inventory management responsibilities personnel with information security responsibilities system developers system/network administrators Test Processes for maintaining the system component inventory automated mechanisms supporting and/or implementing the system component inventory
03.04.04E Automation Support for Baseline Configuration – Assessment Procedure	Assessment Objective Determine if: the currency of the baseline configuration of the system is maintained using [Assignment: automated mechanisms]. the completeness of the baseline configuration of the system is maintained using [Assignment: automated mechanisms]. the accuracy of the baseline configuration of the system is maintained using [Assignment: automated mechanisms]. the availability of the baseline configuration of the system is maintained using [Assignment: automated mechanisms]. Assessment Methods Examine Configuration management policy procedures addressing the baseline configuration of the system configuration management plan system design documentation system architecture and configuration documentation system configuration settings and associated documentation system component inventory configuration change control records system security plan other relevant documents or records Interview Personnel with configuration management responsibilities personnel with information security responsibilities system/network administrators Test Processes for managing baseline configurations automated mechanisms implementing baseline configuration maintenance
03.04.05E Dual Authorization for System Changes – Assessment Procedure	Assessment Objective Determine if: dual authorization for implementing changes to [Assignment: system components] is enforced. dual authorization for implementing changes to [Assignment: system-level information] is enforced. Assessment Methods Examine Configuration management policy procedures addressing access restrictions for changes to the system configuration management plan system design documentation system architecture and configuration documentation system configuration settings and associated documentation change control records system audit records system component inventory system information types system security plan other relevant documents or records Interview Personnel with dual authorization enforcement responsibilities for implementing system changes personnel with information security responsibilities system/network administrators Test Processes for managing access restrictions to change mechanisms implementing dual authorization enforcement
03.04.06E Retention of Previous Configurations – Assessment Procedure	Assessment Objective Determine if: [Assignment: number] previous versions of baseline configurations of the system are retained to support rollback. Assessment Methods Examine Configuration management policy procedures addressing the baseline configuration of the system configuration management plan system architecture and configuration documentation system configuration settings and associated documentation copies of previous baseline configuration versions system security plan other relevant documents or records Interview Personnel with configuration management responsibilities personnel with information security responsibilities system/network administrators Test Processes for managing baseline configurations
03.04.07E Testing, Validation, and Documentation of Changes – Assessment Procedure	Assessment Objective Determine if: changes to the system are tested before finalizing the implementation of the changes. changes to the system are validated before finalizing the implementation of the changes. changes to the system are documented before finalizing the implementation of the changes. Assessment Methods Examine Configuration management policy configuration management plan procedures addressing system configuration change control system architecture and configuration documentation system design documentation test records system configuration settings and associated documentation validation records change control records system audit records system security plan other relevant documents or records Interview Personnel with configuration change control responsibilities personnel with information security responsibilities members of change control board or similar system/network administrators system developers Test Processes for configuration change control mechanisms supporting and/or implementing, testing, validating, and documenting system changes
03.04.08E Centralized Repository – Assessment Procedure	Assessment Objective Determine if: a centralized repository for the inventory of system components is provided. Assessment Methods Examine Configuration management policy procedures addressing system component inventory configuration management plan system design documentation system security plan system component inventory system configuration settings and associated documentation change control records system security plan other relevant documents or records Interview Organizational personnel with component inventory management responsibilities organizational personnel with security responsibilities Test Organizational processes for managing the system component inventory mechanisms supporting and/or implementing system component inventory
03.05.01E Cryptographic Bidirectional Authentication – Assessment Procedure	Assessment Objective Determine if: [Assignment: devices and/or types of devices] are authenticated before establishing a system connection using bidirectional authentication that is cryptographically based. Assessment Methods Examine Identification and authentication policy system security plan procedures addressing device identification and authentication system design documentation configuration settings and associated documentation list of devices requiring unique identification and authentication device connection reports other relevant documents or records Interview Personnel with operational responsibilities for device identification and authentication personnel with information security responsibilities system/network administrators system developers Test Mechanisms supporting and/or implementing device authentication capabilities cryptographically based bidirectional authentication mechanisms
03.05.02E Password Managers – Assessment Procedure	Assessment Objective Determine if: [Assignment: password managers] are employed to generate and manage passwords. passwords are protected using [Assignment: safeguards] . Assessment Methods Examine Identification and authentication policy procedures addressing identifier management system security plan system design documentation mechanisms providing dynamic binding of identifiers and authenticators system configuration settings and associated documentation system audit records other relevant documents or records Interview Personnel with identification and authentication management responsibilities personnel with information security responsibilities system/network administrators Test Mechanisms supporting and/or implementing account management capabilities mechanisms supporting and/or implementing identification and authentication management capabilities for the system
03.05.03E Device Attestation – Assessment Procedure	Assessment Objective Determine if: device identification and authentication are handled based on attestation by [Assignment: organization-defined configuration management process]. Assessment Methods Examine Identification and authentication policy system security plan procedures addressing device identification and authentication procedures addressing device configuration management system design documentation system configuration settings and associated documentation configuration management records change control records system audit records other relevant documents or records Interview Personnel with operational responsibilities for device identification and authentication personnel with information security responsibilities system/network administrators Test Mechanisms supporting and/or implementing device identification and authentication capabilities mechanisms supporting and/or implementing configuration management cryptographic mechanisms supporting device attestation
03.05.04E No Embedded Unencrypted Static Authenticators – Assessment Procedure	Assessment Objective Determine if: unencrypted static authenticators are not embedded in applications or other forms of static storage. Assessment Methods Examine Identification and authentication policy system security plan procedures addressing authenticator management system design documentation system configuration settings and associated documentation logical access scripts application code reviews for detecting unencrypted static authenticators other relevant documents or records Interview Personnel with authenticator management responsibilities personnel with information security responsibilities system/network administrators system developers Test Mechanisms supporting and/or implementing authenticator management capabilities mechanisms implementing authentication in applications
03.05.05E Expiration of Cached Authenticators – Assessment Procedure	Assessment Objective Determine if: the use of cached authenticators is prohibited after [Assignment: time period]. Assessment Methods Examine Identification and authentication policy procedures addressing authenticator management system security plan system design documentation system configuration settings and associated documentation system audit records other relevant documents or records Interview Personnel with authenticator management responsibilities personnel with information security responsibilities system/network administrators system developers Test Mechanisms supporting and/or implementing authenticator management capabilities
03.05.06E Identity Proofing – Assessment Procedure	Assessment Objective Determine if: users who require accounts for logical access to systems based on appropriate identity assurance level requirements as specified in applicable standards and guidelines are identity-proofed. user identities are resolved to a unique individual. identity evidence is collected. identity evidence is validated. identity evidence is verified. Assessment Methods Examine Identification and authentication policy procedures addressing identity proofing system security plan other relevant documents or records Interview Personnel with system operations responsibilities personnel with information security responsibilities system/network administrators system developers personnel with identification and authentication responsibilities Test Mechanisms supporting and/or implementing identification and authentication capabilities
03.05.07E Identity Providers and Authorization Servers – Assessment Procedure	Assessment Objective Determine if: identity providers are employed to manage user, device, and non-person entity identities, attributes, and access rights supporting authentication decisions in accordance with [Assignment: policy] using [Assignment: mechanisms]. identity providers are employed to manage user, device, and non-person entity identities, attributes, and access rights supporting authorization decisions in accordance with [Assignment: policy] using [Assignment: mechanisms]. authorization servers are employed to manage user, device, and non-person entity identities, attributes, and access rights supporting authentication decisions in accordance with [Assignment: policy] using [Assignment: mechanisms]. Assessment Methods Examine Identification and authentication policy procedures addressing user and device identification and authentication system security plan system design documentation system configuration settings and associated documentation other relevant documents or records Interview Organizational personnel with system operations responsibilities organizational personnel with information security responsibilities system/network administrators organizational personnel with account management responsibilities system developers Test Mechanisms supporting and/or implementing identification and authentication capabilities and access rights
03.06.01E Security Operations Center – Assessment Procedure	Assessment Objective Determine if: a security operations center is established. a security operations center is maintained. Assessment Methods Examine Incident response policy contingency planning policy procedures addressing incident handling procedures addressing the security operations center operations mechanisms supporting dynamic response capabilities system security plan contingency plan incident response plan other relevant documents or records Interview Personnel with incident handling responsibilities personnel with information security responsibilities security operations center personnel personnel with contingency planning responsibilities Test Mechanisms that support and/or implement the security operations center capability mechanisms that support and/or implement the incident handling process
03.06.02E Integrated Incident Response Team – Assessment Procedure	Assessment Objective Determine if: an integrated incident response team is established. an integrated incident response team is maintained. the integrated incident response team can be deployed to any location identified by the organization in [Assignment: time period]. Assessment Methods Examine Incident response policy procedures addressing incident handling procedures addressing incident response planning incident response plan system security plan other relevant documents or records Interview Personnel with incident handling responsibilities personnel with information security responsibilities members of the integrated incident response team
03.06.03E Behavior Analysis – Assessment Procedure	Assessment Objective Determine if: anomalous or suspected adversarial behavior in or related to [Assignment: environments or resources] is analyzed. Assessment Methods Examine Incident response policy procedures addressing system monitoring tools and techniques incident response plan system monitoring logs or records system monitoring tools and techniques documentation system configuration settings and associated documentation system security plan system component inventory network diagram system protocols documentation list of acceptable thresholds for false positives and false negatives other relevant documents or records Interview Personnel with information security responsibilities system/network administrators Test Processes for detecting anomalous behavior
03.06.04E Automated Tracking, Data Collection, and Analysis for Incident Monitoring – Assessment Procedure	Assessment Objective Determine if: incidents are tracked using [Assignment: automated mechanisms]. incident information is collected using [Assignment: automated mechanisms]. incident information is analyzed using [Assignment: automated mechanisms]. Assessment Methods Examine Incident response policy procedures addressing incident monitoring incident response records and documentation system security plan incident response plan other relevant documents or records Interview Personnel with incident monitoring responsibilities personnel with information security responsibilities Test Incident monitoring capability for the organization automated mechanisms supporting and/or implementing the tracking and documenting of system security incidents
03.07.01E Software Updates and Patches for Maintenance Tools – Assessment Procedure	Assessment Objective Determine if: maintenance tools are inspected to ensure that the latest software updates and patches are installed. Assessment Methods Examine Maintenance policy procedures addressing system maintenance tools system maintenance tools and associated documentation list of personnel authorized to use maintenance tools maintenance tool usage records maintenance records system security plan other relevant documents or records Interview Personnel with system maintenance responsibilities personnel with information security responsibilities Test Processes for inspecting maintenance tools processes for maintenance tool updates mechanisms supporting and/or implementing the inspection of maintenance tools mechanisms supporting and/or implementing maintenance tool updates
03.08.01E Dual Authorization for Media Sanitization – Assessment Procedure	Assessment Objective Determine if: dual authorization for the sanitization of [Assignment: system media] is enforced. Assessment Methods Examine System media protection policy procedures addressing media sanitization and disposal dual authorization policy and procedures list of system media requiring dual authorization for sanitization authorization records media sanitization records audit records system security plan other relevant documents or records Interview Personnel with system media sanitization responsibilities personnel with information security responsibilities system/network administrators Test Processes requiring dual authorization for media sanitization mechanisms supporting and/or implementing media sanitization mechanisms supporting and/or implementing dual authorization
03.08.02E Dual Authorization for System Backup Deletion and Destruction – Assessment Procedure	Assessment Objective Determine if: dual authorization for the deletion or destruction of [Assignment: system backup information] is enforced. Assessment Methods Examine Contingency planning policy procedures addressing system backup contingency plan system design documentation system configuration settings and associated documentation system-generated list of dual authorization credentials or rules logs or records of the deletion or destruction of backup information system security plan other relevant documents or records Interview Personnel with system backup responsibilities personnel with information security responsibilities Test Mechanisms supporting and/or implementing dual authorization mechanisms supporting and/or implementing the deletion and/or destruction of backup information
03.08.03E Testing System Backups for Reliability and Integrity – Assessment Procedure	Assessment Objective Determine if: backup information is tested [Assignment: frequency] to verify media reliability. backup information is tested [Assignment: frequency] to verify information integrity. Assessment Methods Examine Contingency planning policy procedures addressing system backup contingency plan system backup test results contingency plan test documentation contingency plan test results system security plan other relevant documents or records Interview Personnel with system backup responsibilities personnel with information security responsibilities Test Processes for conducting system backups mechanisms supporting and/or implementing system backups
03.08.04E System Recovery and Reconstitution – Assessment Procedure	Assessment Objective Determine if: the recovery of the system to a known state is provided within [Assignment: time period] after a disruption, compromise, or failure. the reconstitution of the system to a known state is provided within [Assignment: time period] after a disruption, compromise, or failure. Assessment Methods Examine Contingency planning policy procedures addressing system backup contingency plan system backup test results contingency plan test results contingency plan test documentation redundant secondary system for system backups locations of redundant secondary backup systems system security plan other relevant documents or records Interview Organizational personnel with contingency planning, recovery, and/or reconstitution responsibilities organizational personnel with information security responsibilities Test Organizational processes implementing system recovery and reconstitution operations mechanisms supporting and/or implementing system recovery and reconstitution operations
03.09.03E Access Agreements – Assessment Procedure	Assessment Objective Determine if: access agreements are developed and documented for systems processing, storing, or transmitting CUI. access agreements are reviewed [Assignment: frequency] . access agreements are updated [Assignment: frequency] . individuals requiring access to CUI and systems processing, storing, or transmitting CUI sign appropriate access agreements prior to being granted access. individuals requiring access to CUI and systems processing, storing, or transmitting CUI re-sign access agreements to maintain access when access agreements have been updated or [Assignment: frequency] . Assessment Methods Examine Personnel security policy personnel security procedures procedures addressing access agreements for systems processing, storing, or transmitting CUI access control policy access control procedures access agreements (including non-disclosure agreements, acceptable use agreements, rules of behavior, and conflict-of-interest agreements) documentation of access agreement reviews, updates, and re-signing system security plan other relevant documents or records Interview Personnel with personnel security responsibilities personnel who have signed and/or resigned access agreements personnel with information security responsibilities Test Processes for reviewing, updating, and re-signing access agreements mechanisms supporting reviewing, updating, and re-signing of access agreements
03.09.04E Citizenship Requirements – Assessment Procedure	Assessment Objective Determine if: individuals accessing a system processing, storing, or transmitting CUI meet [Assignment: organization-defined citizenship requirements]. Assessment Methods Examine Personnel security policy access control policy, procedures addressing personnel screening records of screened personnel screening criteria records of access authorizations system security plan other relevant documents or records Interview Personnel with personnel security responsibilities personnel with information security responsibilities Test Processes for ensuring valid access authorizations for accessing CUI and systems requiring citizenship processes for additional personnel screening
03.10.01E Intrusion Alarms and Surveillance Equipment – Assessment Procedure	Assessment Objective Determine if: physical access to the facility where the system resides is monitored using physical intrusion alarms. physical access to the facility where the system resides is monitored using physical surveillance equipment. Assessment Methods Examine Physical and environmental protection policy procedures addressing physical access monitoring physical access monitoring records physical access log reviews physical access logs or records system security plan other relevant documents or records Interview Personnel with physical access monitoring responsibilities personnel with incident response responsibilities personnel with information security responsibilities Test Processes for monitoring physical intrusion alarms and surveillance equipment mechanisms supporting and/or implementing physical intrusion alarms and surveillance equipment mechanisms supporting and/or implementing physical access monitoring
03.10.02E Delivery and Removal of System Components – Assessment Procedure	Assessment Objective Determine if: [Assignment: types of system components] are authorized when entering the facility. [Assignment: types of system components] are controlled when entering the facility. [Assignment: types of system components] are authorized when exiting the facility. [Assignment: types of system components] are controlled when exiting the facility. records of the system components entering and exiting the facility are maintained. Assessment Methods Examine Physical and environmental protection policy procedures addressing the delivery and removal of system components from the facility facility housing the system records of items entering and exiting the facility system security plan other relevant documents or records Interview Personnel with responsibilities for controlling system components entering and exiting the facility personnel with information security responsibilities Test Process for authorizing, monitoring, and controlling system-related items entering and exiting the facility mechanisms supporting and/or implementing, authorizing, monitoring, and controlling system components entering and exiting the facility
03.11.01E Threat Awareness Program – Assessment Procedure	Assessment Objective Determine if: a threat awareness program that includes a cross-organization information-sharing capability for threat intelligence is implemented. Assessment Methods Examine Information security program plan threat awareness program policy threat awareness program procedures risk assessment results relevant to threat awareness documentation about the cross-organization information-sharing capability other relevant documents or records Interview Personnel with information security program planning and plan implementation responsibilities personnel responsible for the threat awareness program personnel responsible for the cross-organization information-sharing capability personnel with information security responsibilities external personnel with whom threat awareness information is shared by the organization Test Processes for implementing the threat awareness program processes for implementing the cross-organization information-sharing capability mechanisms supporting and/or implementing the threat awareness program mechanisms supporting and/or implementing the cross-organization information-sharing capability
03.11.02E Threat Hunting – Assessment Procedure	Assessment Objective Determine if: a cyber threat-hunting capability is established to search for indicators of compromise in organizational systems. a cyber threat-hunting capability is maintained to search for indicators of compromise in organizational systems. a cyber threat-hunting capability is established to detect, track, and disrupt threats that evade existing safeguards. a cyber threat-hunting capability is maintained to detect, track, and disrupt threats that evade existing safeguards. the threat-hunting capability is employed[Assignment: frequency]. Assessment Methods Examine Risk assessment policy assessment reports audit records and/or event logs threat-hunting capability system security plan other relevant documents or records Interview Personnel with threat-hunting responsibilities system/network administrators personnel with information security responsibilities Test Processes for assessments and audits mechanisms or tools supporting and/or implementing threat-hunting capabilities
03.11.03E Predictive Cyber Analytics – Assessment Procedure	Assessment Objective Determine if: [Assignment: advanced automation capabilities] are employed to predict and identify risks to [Assignment: systems or system components]. [Assignment: advanced analytics capabilities] are employed to predict and identify risks to [Assignment: systems or system components]. Assessment Methods Examine Risk assessment policy security planning policy and procedures procedures addressing organizational assessments of risk risk assessment risk assessment results risk assessment reviews risk assessment updates risk reports system security plan other relevant documents or records Interview Personnel with risk assessment responsibilities personnel with information security responsibilities Test Processes for risk assessment mechanisms supporting and/or conducting, documenting, reviewing, disseminating, and updating the risk assessment
03.11.08E Dynamic Threat Awareness – Assessment Procedure	Assessment Objective Determine if: the current cyber threat environment is determined on an ongoing basis using [Assignment: means]. Assessment Methods Examine Risk assessment policy security planning policy and procedures procedures addressing organizational assessments of risk risk assessment risk assessment results risk assessment reviews risk assessment updates risk reports system security plan other relevant documents or records Interview Personnel with risk assessment responsibilities personnel with information security responsibilities Test Processes for risk assessment mechanisms supporting and/or conducting, documenting, reviewing, disseminating, and updating the risk assessment
03.11.09E Indicators of Compromise – Assessment Procedure	Assessment Objective Determine if: indicators of compromise provided by [Assignment: sources] are discovered. indicators of compromise provided by [Assignment: sources] are collected. indicators of compromise provided by [Assignment: sources] are distributed to [Assignment: personnel or roles]. Assessment Methods Examine System and information integrity policy system and information integrity procedures procedures addressing system monitoring system design documentation system monitoring tools and techniques documentation system configuration settings and associated documentation system monitoring logs or records system audit records system security plan other relevant documents or records Interview System/network administrators personnel with information security responsibilities system developers personnel installing, configuring, and/or maintaining the system personnel responsible for monitoring system hosts Test Processes for system monitoring processes for the discovery, collection, distribution, and use of indicators of compromise mechanisms supporting and/or implementing a system monitoring capability mechanisms supporting and/or implementing the discovery, collection, distribution, and use of indicators of compromise
03.11.10E Criticality Analysis – Assessment Procedure	Assessment Objective Determine if: critical system components and functions are identified by performing a criticality analysis for [Assignment: systems, system components, or system services] at [Assignment: decision points]. Assessment Methods Examine Risk assessment policy assessment reports criticality analysis and/or finalized criticality for each component and/or subcomponent audit records and/or event logs analysis reports system security plan other relevant documents or records Interview Personnel with assessment and auditing responsibilities personnel with criticality analysis responsibilities system/network administrators personnel with information security responsibilities Test Processes for assessments and audits mechanisms and/or tools supporting and/or implementing assessments and auditing
03.11.11E Discoverable Information – Assessment Procedure	Assessment Objective Determine if: discoverable information about the system is identified. [Assignment: corrective actions] are taken when information about the system is confirmed as discoverable. Assessment Methods Examine Procedures addressing vulnerability scanning assessment report penetration test results vulnerability scanning results risk assessment report records of corrective actions taken on discoverable information incident response records audit records system security plan other relevant documents or records Interview Personnel with vulnerability scanning and/or penetration testing responsibilities personnel with vulnerability scan analysis responsibilities personnel responsible for risk response personnel responsible for incident management and response personnel with information security responsibilities Test Processes for vulnerability scanning processes for risk response processes for incident management and response mechanisms and/or tools supporting and/or implementing vulnerability scanning mechanisms supporting and/or implementing risk response mechanisms supporting and/or implementing incident management and response
03.11.12E Automated Means for Sharing Threat Intelligence – Assessment Procedure	Assessment Objective Determine if: automated mechanisms are employed to maximize the effectiveness of sharing threat intelligence information. Assessment Methods Examine Information security program plan threat awareness program policy threat awareness program procedures risk assessment results related to threat awareness documentation about the cross-organization information-sharing capability other relevant documents or records Interview Personnel with information security program planning and plan implementation responsibilities personnel responsible for the threat awareness program personnel responsible for the cross-organization information-sharing capability personnel with information security responsibilities external personnel with whom threat awareness information is shared by the organization Test Processes for implementing the threat awareness program processes for implementing the cross-organization information-sharing capability automated mechanisms supporting and/or implementing the threat awareness program automated mechanisms supporting and/or implementing the cross-organization information-sharing capability
03.12.01E Penetration Testing – Assessment Procedure	Assessment Objective Determine if: penetration testing is conducted [Assignment: frequency] on [Assignment: systems or system components]. Assessment Methods Examine Assessment and monitoring policy procedures addressing penetration testing assessment plan system security plan penetration test rules of engagement penetration test report assessment report assessment evidence other relevant documents or records Interview Personnel with assessment responsibilities personnel with information security responsibilities system/network administrators Test Mechanisms supporting penetration testing
03.12.02E Independent Assessors – Assessment Procedure	Assessment Objective Determine if: independent assessors or assessment teams are used to conduct security requirement assessments. Assessment Methods Examine Assessment and monitoring policy procedures addressing assessments previous assessment plan previous assessment report plan of action and milestones system security plan other relevant documents or records Interview Personnel with assessment responsibilities personnel with information security responsibilities
03.12.03E Risk Monitoring – Assessment Procedure	Assessment Objective Determine if: risk monitoring is an integral part of the continuous monitoring strategy. effectiveness monitoring is included in risk monitoring. compliance monitoring is included in risk monitoring. change monitoring is included in risk monitoring. Assessment Methods Examine Assessment and monitoring policy organizational continuous monitoring strategy system-level continuous monitoring strategy procedures addressing continuous monitoring of system assessment report plan of action and milestones system monitoring records impact analyses status reports system security plan other relevant documents or records Interview Personnel with continuous monitoring responsibilities personnel with information security responsibilities Test Mechanisms supporting risk monitoring
03.12.04E Internal System Connections – Assessment Procedure	Assessment Objective Determine if: internal connections of [Assignment: system components or classes of components] to the system are authorized. for each internal connection, the interface characteristics are documented. for each internal connection, the security requirements are documented. for each internal connection, the nature of the information communicated is documented. internal system connections are terminated after [Assignment: conditions]. the continued need for each internal connection is reviewed [Assignment: frequency]. Assessment Methods Examine Assessment and monitoring policy access control policy procedures addressing system connections system and communications protection policy system design documentation system audit records list of components or classes of components authorized as internal system connections system security plan system configuration settings and associated documentation assessment report other relevant documents or records Interview Personnel with responsibilities for developing, implementing, or authorizing internal system connections personnel with information security and responsibilities Test Mechanisms supporting internal system connections
03.13.01E Heterogeneity – Assessment Procedure	Assessment Objective Determine if: a diverse set of information technologies is employed for [Assignment: system components] in the implementation of the system. Assessment Methods Examine System and communications protection policy system design documentation system configuration settings and associated documentation list of technologies deployed in the system acquisition documentation acquisition contracts for system components or services system security plan other relevant documents or records Interview System/network administrators personnel with information security responsibilities personnel with system acquisition, development, and implementation responsibilities Test Mechanisms supporting and/or implementing the use of a diverse set of information technologies
03.13.02E Randomness – Assessment Procedure	Assessment Objective Determine if: [Assignment: techniques] are employed to introduce randomness into organizational operations and assets. Assessment Methods Examine System and communications protection policy procedures addressing concealment and misdirection techniques for the system system design documentation system configuration settings and associated documentation system architecture list of techniques to be used to introduce randomness into organizational operations and assets system audit records system security plan other relevant documents or records Interview System/network administrators personnel with the responsibility to implement concealment and misdirection techniques for systems personnel with information security responsibilities Test Mechanisms supporting and/or implementing randomness as a concealment and misdirection technique
03.13.03E Concealment and Misdirection – Assessment Procedure	Assessment Objective Determine if: [Assignment: concealment and misdirection techniques] are used to mislead adversaries. Assessment Methods Examine System and communications protection policy procedures addressing concealment and misdirection techniques for the system system design documentation system configuration settings and associated documentation system architecture list of concealment and misdirection techniques to be used for organizational systems system audit records system security plan other relevant documents or records Interview System/network administrators personnel with information security responsibilities personnel with the responsibility to implement concealment and misdirection techniques for systems Test Mechanisms supporting and/or implementing concealment and misdirection techniques
03.13.04E Isolation of System Components – Assessment Procedure	Assessment Objective Determine if: boundary protection mechanisms are employed to isolate [Assignment: system components]. Assessment Methods Examine System and communications protection policy procedures addressing boundary protection system design documentation system hardware and software enterprise architecture documentation system architecture system configuration settings and associated documentation system audit records system security plan other relevant documents or records Interview System/network administrators personnel with information security responsibilities personnel with boundary protection responsibilities Test Mechanisms supporting and/or implementing the capability to separate system components
03.13.05E Change Processing and Storage Locations – Assessment Procedure	Assessment Objective Determine if: the location of [Assignment: processing and/or storage] is changed [Assignment: SELECTED PARAMETER VALUE]. Assessment Methods Examine System and communications protection policy configuration management policy and procedures procedures addressing concealment and misdirection techniques for the system list of processing and/or storage locations to be changed at organizational time intervals change control records configuration management records system audit records system security plan other relevant documents or records Interview System/network administrators personnel with information security responsibilities personnel with the responsibility to change processing and/or storage locations Test Mechanisms supporting and/or implementing changing processing and/or storage locations
03.13.06E Platform-Independent Applications – Assessment Procedure	Assessment Objective Determine if: [Assignment: platform-independent applications] are implemented within organizational systems. Assessment Methods Examine System and communications protection policy procedures addressing platform-independent applications system design documentation system configuration settings and associated documentation list of platform-independent applications system audit records system security plan other relevant documents or records Interview System/network administrators personnel with information security responsibilities system developers Test Mechanisms supporting and/or implementing platform-independent applications
03.13.07E Virtualization Techniques – Assessment Procedure	Assessment Objective Determine if: virtualization techniques are employed to support the deployment of a diverse range of operating systems and applications that are changed [Assignment: frequency]. Assessment Methods Examine System and communications protection policy configuration management policy and procedures system design documentation system configuration settings and associated documentation system architecture list of operating systems and applications deployed using virtualization techniques change control records configuration management records system audit records system security plan other relevant documents or records Interview System/network administrators personnel with information security responsibilities personnel with responsibilities for implementing approved virtualization techniques to the system Test Mechanisms supporting and/or implementing the use of a diverse set of information technologies mechanisms supporting and/or implementing virtualization techniques
03.13.08E Decoys – Assessment Procedure	Assessment Objective Determine if: components within organizational systems specifically designed to be the target of malicious attacks are included to detect such attacks. components within organizational systems specifically designed to be the target of malicious attacks are included to deflect such attacks. components within organizational systems specifically designed to be the target of malicious attacks are included to analyze such attacks. Assessment Methods Examine System and communications protection policy procedures addressing the use of decoys system design documentation system configuration settings and associated documentation system audit records system security plan other relevant documents or records Interview System/network administrators personnel with information security responsibilities system developers Test Mechanisms supporting and/or implementing decoys
03.13.09E Isolation of Security Tools, Mechanisms, and Support Components – Assessment Procedure	Assessment Objective Determine if: [Assignment: information security tools, mechanisms, and support components] are isolated from other internal system components by implementing physically separate subnetworks with managed interfaces to other components of the system. Assessment Methods Examine System and communications protection policy procedures addressing boundary protection system design documentation system hardware and software system architecture system configuration settings and associated documentation list of security tools and support components to be isolated from other internal system components system audit records system security plan other relevant documents or records Interview System/network administrators personnel with information security responsibilities personnel with boundary protection responsibilities Test Mechanisms supporting and/or implementing the isolation of information security tools, mechanisms, and support components
03.13.10E Separate Subnetworks – Assessment Procedure	Assessment Objective Determine if: separate network addresses are implemented to connect to systems in different security domains. Assessment Methods Examine System and communications protection policy procedures addressing boundary protection system design documentation system hardware and software system architecture system configuration settings and associated documentation system audit records system security plan other relevant documents or records Interview System/network administrators personnel with information security responsibilities system developers personnel with boundary protection responsibilities Test Mechanisms supporting and/or implementing separate network addresses or different subnets
03.13.11E Thin Nodes – Assessment Procedure	Assessment Objective Determine if: minimal functionality for [Assignment: system components] is employed. minimal information storage on [Assignment: system components] is employed. Assessment Methods Examine System and communications protection policy procedures addressing use of thin nodes system design documentation system configuration settings and associated documentation system audit records system security plan other relevant documents or records Interview System/network administrators personnel with information security responsibilities Test Mechanisms supporting and/or implementing thin nodes
03.13.12E Denial-of-Service Protection – Assessment Procedure	Assessment Objective Determine if: the effects of [Assignment: types of denial-of-service events] are [Assignment: SELECTED PARAMETER VALUE]. [Assignment: safeguards] are employed to protect against or limit the effects of denial-of-service events. Assessment Methods Examine System and communications protection policy procedures addressing denial-of-service protection list of denial-of-service attacks requiring employment of security safeguards to protect against or limit effects of such attacks system design documentation list of security safeguards protecting against or limiting the effects of denial-of-service attacks system configuration settings and associated documentation system audit records system security plan other relevant documents or records Interview System/network administrators personnel with information security responsibilities personnel with incident response responsibilities system developers Test Mechanisms protecting against or limiting the effects of denial-of-service attacks
03.13.13E Port and Input/Output Device Access – Assessment Procedure	Assessment Objective Determine if: [Assignment: connection ports or input/output devices] are [Assignment: SELECTED PARAMETER VALUE] disabled or removed on [Assignment: systems or system components]. Assessment Methods Examine System and communications protection policy access control policy and procedures procedures addressing port and input/output device access system design documentation system architecture system configuration settings and associated documentation systems or system components list of connection ports or input/output devices to be physically disabled or removed on systems or system components system security plan other relevant documents or records Interview System/network administrators personnel with information security responsibilities personnel installing, configuring, and/or maintaining the system Test Mechanisms supporting and/or implementing the disabling of connection ports or input/output devices
03.13.14E Detonation Chambers – Assessment Procedure	Assessment Objective Determine if: a detonation chamber capability is employed within the [Assignment: system, system component, or location]. Assessment Methods Examine System and communications protection policy procedures addressing detonation chambers system configuration settings and associated documentation system audit records system design documentation system security plan other relevant documents or records Interview system/network administrators personnel with information security responsibilities personnel installing, configuring, and/or maintaining the system Test Mechanisms supporting and/or implementing the detonation chamber capability
03.13.15E Separate Subnets to Isolate System Components and Functions – Assessment Procedure	Assessment Objective Determine if: subnetworks are separated [Assignment: SELECTED PARAMETER VALUE] to isolate [Assignment: critical system components and functions]. Assessment Methods Examine System and communications protection policy procedures addressing boundary protection system design documentation system hardware and software system architecture system configuration settings and associated documentation criticality analysis system audit records system security plan other relevant documents or records Interview System/network administrators organizational personnel with information security responsibilities system developer organizational personnel with boundary protection responsibilities Test Mechanisms separating critical system components and functions
03.13.16E System Partitioning – Assessment Procedure	Assessment Objective Determine if: the system is partitioned into [Assignment: system components] residing in separate [Assignment: SELECTED PARAMETER VALUE] security domains or environments based on [Assignment: circumstances]. Assessment Methods Examine System and communications protection policy procedures addressing system partitioning system design documentation system configuration settings and associated documentation system architecture list of system physical domains (or environments) system facility diagrams system network diagrams system security plan other relevant documents or records Interview System/network administrators organizational personnel with information security responsibilities organizational personnel installing, configuring, and/or maintaining the system system developers/integrators Test Mechanisms supporting and/or implementing the physical separation of system components
03.14.01E Software, Firmware, and Information Integrity – Assessment Procedure	Assessment Objective Determine if: integrity verification tools are employed to detect unauthorized changes to [Assignment: software]. integrity verification tools are employed to detect unauthorized changes to [Assignment: firmware]. integrity verification tools are employed to detect unauthorized changes to [Assignment: information]. [Assignment: actions] are taken when unauthorized changes to software are detected. [Assignment: actions] are taken when unauthorized changes to firmware are detected. [Assignment: actions] are taken when unauthorized changes to information are detected. Assessment Methods Examine System and information integrity policy system and information integrity procedures procedures addressing software, firmware, and information integrity system configuration settings and associated documentation integrity verification tools and associated documentation records generated or triggered by system design documentation integrity verification tools regarding unauthorized software, firmware, and information changes system audit records system security plan other relevant documents or records Interview Personnel responsible for software, firmware, and/or information integrity personnel with information security responsibilities system/network administrators Test Software, firmware, and information integrity verification tools
03.14.04E Refresh From Trusted Sources – Assessment Procedure	Assessment Objective Determine if: the software and data used during system component and service refreshes are obtained from [Assignment: trusted sources]. Assessment Methods Examine System and information integrity policy system and information integrity procedures system design documentation procedures addressing non-persistence for system components system configuration settings and associated documentation system audit records system security plan other relevant documents or records Interview Personnel responsible for obtaining component and service refreshes from trusted sources personnel with information security responsibilities Test Processes for defining and obtaining component and service refreshes from trusted sources automated mechanisms supporting and/or implementing component and service refreshes
03.14.05E Non-Persistent Information – Assessment Procedure	Assessment Objective Determine if: [Assignment: SELECTED PARAMETER VALUE] is performed. information is deleted when no longer needed. Assessment Methods Examine System and information integrity policy system and information integrity procedures system security plan procedures addressing non-persistence for system components system design documentation system configuration settings and associated documentation system audit records other relevant documents or records Interview Personnel responsible for ensuring that information is and remains non-persistent personnel with information security responsibilities Test Processes for ensuring that information is and remains non-persistent automated mechanisms supporting and/or implementing component and service refreshes
03.14.08E Integrity Checks – Assessment Procedure	Assessment Objective Determine if: an integrity check of [Assignment: software] is performed [Assignment: SELECTED PARAMETER VALUE(S)]. an integrity check of [Assignment: firmware] is performed [Assignment: SELECTED PARAMETER VALUE(S)]. an integrity check of [Assignment: information] is performed [Assignment: SELECTED PARAMETER VALUE(S)]. Assessment Methods Examine System and information integrity policy system and information integrity procedures procedures addressing software, firmware, and information integrity testing system design documentation system configuration settings and associated documentation system security plan integrity verification tools and associated documentation records of integrity scans other relevant documents or records Interview Personnel responsible for software, firmware, and/or information integrity personnel with information security responsibilities system/network administrators system developers Test Software, firmware, and information integrity verification tools
03.14.09E Cryptographic Protection – Assessment Procedure	Assessment Objective Determine if: cryptographic mechanisms are implemented to detect unauthorized changes to software. cryptographic mechanisms are implemented to detect unauthorized changes to firmware. cryptographic mechanisms are implemented to detect unauthorized changes to information. Assessment Methods Examine System and information integrity policy system and information integrity procedures procedures addressing software, firmware, and information integrity system design documentation system configuration settings and associated documentation system audit records system security plan cryptographic mechanisms and associated documentation records of detected unauthorized changes to software, firmware, and information other relevant documents or records Interview Personnel responsible for software, firmware, and/or information integrity personnel with information security responsibilities system/network administrators system developers Test Software, firmware, and information integrity verification tools cryptographic mechanisms implementing software, firmware, and information integrity
03.14.10E Protection of Boot Firmware – Assessment Procedure	Assessment Objective Determine if: [Assignment: mechanisms] are implemented to protect the integrity of boot firmware in [Assignment: system components]. Assessment Methods Examine System and information integrity policy system and information integrity procedures procedures addressing software, firmware, and information integrity system design documentation system configuration settings and associated documentation system security plan integrity verification tools and associated documentation records of integrity verification scans system audit records other relevant documents or records Interview Personnel responsible for software, firmware, and/or information integrity personnel with information security responsibilities system/network administrators system developer Test Software, firmware, and information integrity verification tools mechanisms supporting and/or implementing protection of the integrity of boot firmware safeguards implementing protection of the integrity of boot firmware
03.14.11E Integration of Detection and Response – Assessment Procedure	Assessment Objective Determine if: the detection of [Assignment: changes] are incorporated into the organizational incident response capability. Assessment Methods Examine System and information integrity policy system and information integrity procedures procedures addressing software, firmware, and information integrity procedures addressing incident response system design documentation system configuration settings and associated documentation incident response records audit records system security plan other relevant documents or records Interview Personnel responsible for software, firmware, and/or information integrity personnel with information security responsibilities personnel with incident response responsibilities Test Processes for incorporating the detection of unauthorized security-relevant changes into the incident response capability mechanisms supporting and/or implementing the incorporation of detection of unauthorized security-relevant changes into the incident response capability software, firmware, and information integrity verification tools
03.14.12E Information Input Validation – Assessment Procedure	Assessment Objective Determine if: the validity of the [Assignment: information inputs] is checked. Assessment Methods Examine System and information integrity policy system and information integrity procedures access control policy and procedures separation of duties policy and procedures procedures addressing information input validation documentation for automated tools and applications to verify the validity of information list of information inputs requiring validity checks system design documentation system configuration settings and associated documentation system audit records system security plan other relevant documents or records Interview Personnel responsible for information input validation personnel with information security responsibilities system/network administrators system developers Test Mechanisms supporting and/or implementing validity checks on information inputs
03.14.13E Error Handling – Assessment Procedure	Assessment Objective Determine if: error messages that provide the information necessary for corrective actions are generated without revealing information that could be exploited. error messages are revealed only to [Assignment: personnel or roles]. Assessment Methods Examine System and information integrity policy system and information integrity procedures procedures addressing system error handling system design documentation system configuration settings and associated documentation documentation providing the structure and content of error messages system audit records system security plan other relevant documents or records Interview Personnel responsible for information input validation personnel with information security responsibilities system/network administrators system developers Test Processes for error handling automated mechanisms supporting and/or implementing error handling automated mechanisms supporting and/or implementing the management of error messages
03.14.14E Memory Protection – Assessment Procedure	Assessment Objective Determine if: [Assignment: safeguards] are implemented to protect the system memory from unauthorized code execution. Assessment Methods Examine System and information integrity policy system and information integrity procedures procedures addressing memory protection for the system system design documentation system configuration settings and associated documentation list of security safeguards protecting system memory from unauthorized code execution system audit records system security plan other relevant documents or records Interview Personnel responsible for memory protection personnel with information security responsibilities system/network administrators system developers Test Automated mechanisms supporting and/or implementing safeguards to protect the system memory from unauthorized code execution
03.14.15E Non-Persistent System Components and Services – Assessment Procedure	Assessment Objective Determine if: [Assignment: non-persistent system components and services] are implemented. [Assignment: non-persistent system components and services] are initiated from a known state. [Assignment: non-persistent system components and services] are terminated [Assignment: SELECTED PARAMETER VALUE(S)]. Assessment Methods Examine System and information integrity policy system and information integrity procedures system design documentation procedures addressing non-persistence for system components system security plan system configuration settings and associated documentation system audit records other relevant documents or records Interview Personnel responsible for non-persistence personnel with information security responsibilities system/network administrators system developers Test Automated mechanisms supporting and/or implementing the initiation and termination of non-persistent components
03.14.16E Tainting – Assessment Procedure	Assessment Objective Determine if: data or capabilities are embedded in [Assignment: systems or system components] to determine if CUI has been exfiltrated or improperly removed from the organization. Assessment Methods Examine System and information integrity policy system and information integrity procedures procedures addressing software and information integrity system design documentation system configuration settings and associated documentation policy and procedures addressing the systems security engineering technique of deception system security plan other relevant documents or records Interview Personnel responsible for detecting tainted data personnel with systems security engineering responsibilities personnel with information security responsibilities Test Automated mechanisms for post-breach detection decoys, traps, lures, and methods for deceiving adversaries detection and notification mechanisms
03.14.17E System-Generated Alerts – Assessment Procedure	Assessment Objective Determine if: [Assignment: personnel or roles] are alerted when system-generated [Assignment: indicators of compromise] occur. Assessment Methods Examine System and information integrity policy system and information integrity procedures system security plan system audit records procedures addressing system monitoring tools and techniques system monitoring tools and techniques documentation list of personnel selected to receive alerts system configuration settings and associated documentation documentation of alerts generated based on compromise indicators other relevant documents or records Interview Personnel with information security responsibilities system developers personnel installing, configuring, and/or maintaining the system personnel responsible for monitoring the system personnel on the system alert notification list personnel responsible for the intrusion detection system system/network administrators Test Processes for intrusion detection and system monitoring mechanisms supporting and/or implementing intrusion detection and system monitoring capabilities mechanisms supporting and/or implementing alerts for compromise indicators
03.14.18E Automated Organization-Generated Alerts – Assessment Procedure	Assessment Objective Determine if: [Assignment: personnel or roles] are alerted using [Assignment: automated mechanisms] when [Assignment: activities] indicate inappropriate or unusual activities with security implications. Assessment Methods Examine System and information integrity policy system and information integrity procedures system security plan list of inappropriate or unusual activities with security implications that trigger alerts suspicious activity reports system monitoring tools and techniques documentation system design documentation procedures addressing system monitoring tools and techniques alerts provided to security personnel system configuration settings and associated documentation system monitoring logs or records system audit records other relevant documents or records Interview Personnel with information security responsibilities system developers personnel installing, configuring, and/or maintaining the system personnel responsible for monitoring the system personnel responsible for the intrusion detection system system/network administrators Test Processes for intrusion detection and system monitoring automated mechanisms supporting and/or implementing intrusion detection and system monitoring capabilities automated mechanisms supporting and/or implementing automated alerts to security personnel
03.14.19E Wireless Intrusion Detection – Assessment Procedure	Assessment Objective Determine if: a wireless intrusion detection system is employed to identify rogue wireless devices. a wireless intrusion detection system is employed to detect attack attempts on the system. a wireless intrusion detection system is employed to detect a potential compromise or breach to the system. Assessment Methods Examine System and information integrity policy system and information integrity procedures procedures addressing system monitoring tools and techniques system design documentation system monitoring tools and techniques documentation system configuration settings and associated documentation system protocols system audit records system security plan other relevant documents or records Interview System/network administrators organizational personnel with information security responsibilities organizational personnel installing, configuring, and/or maintaining the system organizational personnel responsible for monitoring the system organizational personnel responsible for the intrusion detection system Test Organizational processes for intrusion detection mechanisms supporting and/or implementing a wireless intrusion detection capability
03.15.01E Security Architecture – Assessment Procedure	Assessment Objective Determine if: a security architecture for the system that describes the requirements and approach to be taken for protecting the confidentiality, integrity, and availability of CUI is developed. a security architecture for the system that describes how the security architecture is integrated into and supports the enterprise architecture is developed. a security architecture for the system that describes any assumptions about and dependencies on external systems and services is developed. the security architecture is reviewed and updated [Assignment: frequency] to reflect changes in the enterprise architecture. planned security architecture changes are reflected in system security plans, concept of operations, criticality analyses, organizational procedures, procurements, and acquisitions. Assessment Methods Examine Security planning policy procedures addressing information security architecture development procedures addressing information security architecture reviews and updates enterprise architecture documentation information security architecture documentation system security plan security CONOPS for the system records of information security architecture reviews and updates other relevant documents or records Interview Personnel with security planning and plan implementation responsibilities personnel with information security responsibilities personnel with information security architecture development responsibilities Test Mechanisms supporting and/or implementing the development, review, and update of the information security architecture processes for developing, reviewing, and updating the information security architecture
03.15.02E Defense In Depth – Assessment Procedure	Assessment Objective Determine if: the security architecture for the system is designed using a defense-in-depth approach. [Assignment: security requirements] are allocated to [Assignment: architectural layers and locations]. the security requirements allocated to the architectural layers and locations are coordinated and mutually reinforcing. Assessment Methods Examine Security planning policy procedures addressing information security architecture development enterprise architecture documentation information security architecture documentation system security plan security CONOPS for the system other relevant documents or records Interview Personnel with information security responsibilities personnel with information security architecture development responsibilities personnel with security planning and plan implementation responsibilities Test Processes for designing the information security architecture mechanisms supporting and/or implementing the design of the information security architecture
03.15.03E Supplier Diversity – Assessment Procedure	Assessment Objective Determine if: [Assignment: safeguards] that are allocated to [Assignment: architectural layers and locations] are obtained from different suppliers. Assessment Methods Examine Security planning policy procedures addressing information security architecture development enterprise architecture documentation information security architecture documentation system security plan security CONOPS for the system IT acquisitions policy other relevant documents or records Interview Personnel with acquisition responsibilities personnel with information security responsibilities personnel with security planning and plan implementation responsibilities personnel with information security architecture development responsibilities Test Processes for obtaining information security safeguards from different suppliers
03.16.01E Specialization – Assessment Procedure	Assessment Objective Determine if: [Assignment: SELECTED PARAMETER VALUE(S)] is/are employed to [Assignment: systems or system components] supporting mission-essential services or functions to increase the trustworthiness in those systems or components. Assessment Methods Examine System and services acquisition policy procedures addressing design modification, augmentation, or reconfiguration of systems or system components documented evidence of design modification, augmentation, or reconfiguration system security plan supply chain risk management plan other relevant documents or records Interview Personnel with system and service acquisition responsibilities personnel with information security responsibilities personnel with security architecture responsibilities personnel with configuration management responsibilities Test Processes for the modification, design, augmentation, or reconfiguration of systems or system components mechanisms supporting and/or implementing design modification, augmentation, or reconfiguration of systems or system components
03.17.01E Notification Agreements – Assessment Procedure	Assessment Objective Determine if: agreements and procedures are established with entities involved in the supply chain for the system, system components, or system service for [Assignment: SELECTED PARAMETER VALUE(S)]. Assessment Methods Examine Supply chain risk management policy and procedures supply chain risk management plan system and services acquisition policy acquisition contracts for the system, system component, or system service procedures addressing supply chain protection acquisition documentation service-level agreements system security plan inter-organizational agreements and procedures other relevant documents or records Interview Personnel with system and service acquisition responsibilities personnel with information security responsibilities personnel with supply chain risk management responsibilities Test Processes for establishing inter-organizational agreements and procedures with supply chain entities
03.17.02E Inspection of Systems or Components – Assessment Procedure	Assessment Objective Determine if: [Assignment: systems or system components] are inspected [Assignment: SELECTED PARAMETER VALUE(S)] to detect tampering. Assessment Methods Examine Supply chain risk management policy and procedures supply chain risk management plan system and services acquisition policy records of random inspections inspection reports or results assessment reports or results acquisition documentation acquisition contracts for the system, system component, or system service inter-organizational agreements and procedures system security plan service-level agreements other relevant documents or records Interview Personnel with system and services acquisition responsibilities personnel with information security responsibilities personnel with supply chain risk management responsibilities Test Processes for establishing inter-organizational agreements and procedures with supply chain entities processes to inspect for tampering
03.17.03E Component Authenticity – Assessment Procedure	Assessment Objective Determine if: an anti-counterfeit policy is developed and implemented. anti-counterfeit procedures are developed and implemented. the anti-counterfeit policy and procedures include the means to detect counterfeit components entering the system. the anti-counterfeit policy and procedures include the means to prevent counterfeit components from entering the system. counterfeit system components are reported to [Assignment: SELECTED PARAMETER VALUE(S)]. Assessment Methods Examine Supply chain risk management policy and procedures supply chain risk management plan system and services acquisition policy anti-counterfeit plan anti-counterfeit policy and procedures media disposal policy media protection policy incident response policy reports notifying developers, manufacturers, vendors, contractors, and/or external reporting organizations of counterfeit system components acquisition documentation service-level agreements acquisition contracts for the system, system component, or system service inter-organizational agreements and procedures records of reported counterfeit system components system security plan other relevant documents or records Interview Personnel with system and service acquisition responsibilities personnel with information security responsibilities personnel with supply chain risk management responsibilities personnel with responsibilities for anti-counterfeit policies, procedures, and reporting Test Processes for counterfeit prevention, detection, and reporting mechanisms supporting and/or implementing anti-counterfeit detection, prevention, and reporting
03.17.04E Provenance – Assessment Procedure	Assessment Objective Determine if: valid provenance is documented for [Assignment: systems, system components, and associated CUI]. valid provenance is monitored for [Assignment: systems, system components, and associated CUI]. valid provenance is maintained for [Assignment: systems, system components, and associated CUI]. Assessment Methods Examine Supply chain risk management policy supply chain risk management procedures supply chain risk management plan documentation of critical systems, critical system components, and associated data documentation showing the history of ownership, custody, and location of and changes to critical systems or critical system components system architecture inter-organizational agreements and procedures contracts system security plan other relevant documents or records Interview Organizational personnel with acquisition responsibilities organizational personnel with information security responsibilities organizational personnel with supply chain risk management responsibilities Test Organizational processes for identifying the provenance of critical systems and critical system components mechanisms used to document, monitor, or maintain provenance
03.17.05E Supply Chain Integrity – Pedigree – Assessment Procedure	Assessment Objective Determine if: [Assignment: safeguards] are employed to ensure the integrity of the system and system components. [Assignment: analysis method] is conducted to ensure the integrity of the system and system components. Assessment Methods Examine Supply chain risk management policy and procedures supply chain risk management plan system and services acquisition policy procedures addressing supply chain protection bill of materials for critical systems or system components acquisition documentation software identification tags manufacturer declarations of platform attributes (e.g., serial numbers, hardware component inventory) and measurements (e.g., firmware hashes) that are tightly bound to the hardware itself system security plan other relevant documents or records Interview Organizational personnel with system and services acquisition responsibilities organizational personnel with information security responsibilities organizational personnel with supply chain risk management responsibilities Test Organizational processes for identifying pedigree information organizational processes to determine and validate the integrity of the internal composition of critical systems and critical system components mechanisms to determine and validate the integrity of the internal composition of critical systems and critical system components

03.01.01E Dual Authorization – Assessment Procedure

Assessment Objective

Determine if:

dual authorization is enforced for [Assignment: privileged commands and/or other actions].

Assessment Methods

Examine

Access control policy
procedures addressing access enforcement and dual authorization
system design documentation
system configuration settings and associated documentation
list of actions requiring dual authorization
list of privileged commands requiring dual authorization
list of approved authorizations (user privileges)
system security plan
other relevant documents or records

Interview

Personnel with access enforcement responsibilities
system/network administrators
system developers
personnel with information security responsibilities

Test

Dual authorization mechanisms implementing access control policy

03.01.02E Non-Organizationally Owned Systems - Restricted Use – Assessment Procedure

Assessment Objective

Determine if:

the use of non-organizationally owned systems or system components to process, store, or transmit CUI is restricted using [Assignment: restrictions].

Assessment Methods

Examine

Access control policy
procedures addressing the use of external systems
system design documentation
system configuration settings and associated documentation
system connection or processing agreements
account management documents
system audit records
other relevant documents or records

Interview

Personnel with responsibilities for restricting or prohibiting the use of non-organizationally owned systems, system components, or devices
system/network administrators
personnel with information security responsibilities

Test

Mechanisms implementing restrictions on the use of non-organizationally owned systems, components, or devices

03.01.04E Concurrent Session Control – Assessment Procedure

Assessment Objective

Determine if:

the number of concurrent sessions for each [Assignment: account and/or account types] is limited to [Assignment: number].

Assessment Methods

Examine

Access control policy
procedures addressing concurrent session control
system design documentation
system configuration settings and associated documentation
security plan
system security plan
other relevant documents or records

Interview

System/network administrators
personnel with information security responsibilities
system developers

Test

Mechanisms implementing access control policy for concurrent session control

03.01.05E Remote Access Monitoring and Control – Assessment Procedure

Assessment Objective

Determine if:

automated mechanisms are employed to monitor remote access methods.
automated mechanisms are employed to control remote access methods.

Assessment Methods

Examine

Access control policy
procedures addressing remote access to the system
system design documentation
system configuration settings and associated documentation
system audit records
system monitoring records
system security plan
other relevant documents or records

Interview

System/network administrators
personnel with information security responsibilities
system developers

Test

Automated mechanisms monitoring and controlling remote access methods

03.01.06E Protection of Remote Access Mechanism Information – Assessment Procedure

Assessment Objective

Determine if:

information about remote access mechanisms is protected from unauthorized use and disclosure.

Assessment Methods

Examine

Access control policy
procedures addressing remote access to the system
system security plan
other relevant documents or records

Interview

Personnel with responsibilities for implementing or monitoring remote access to the system
system users with knowledge of information about remote access mechanisms
personnel with information security responsibilities

03.01.07E Automated Audit Actions for Account Management – Assessment Procedure

Assessment Objective

Determine if:

automated mechanisms are used to audit account creation actions.
automated mechanisms are used to audit account modification actions.
automated mechanisms are used to audit account enabling actions.
automated mechanisms are used to audit account disabling actions.
automated mechanisms are used to audit account removal actions.

Assessment Methods

Examine

Access control policy
procedures addressing account management
system design documentation
system configuration settings and associated documentation
notifications or alerts of account creation, modification, enabling, disabling, and removal actions
system audit records
system security plan
other relevant documents or records

Interview

Personnel with account management responsibilities
system/network administrators
personnel with information security responsibilities

Test

Automated mechanisms implementing account management functions

03.01.08E Account Monitoring for Atypical Usage – Assessment Procedure

Assessment Objective

Determine if:

system accounts are monitored for [Assignment: atypical usage].
atypical usage of system accounts is reported to [Assignment: personnel or roles].

Assessment Methods

Examine

Access control policy
procedures addressing account management
system design documentation
system configuration settings and associated documentation
system monitoring records
system audit records
audit tracking and monitoring reports
system security plan
other relevant documents or records

Interview

Personnel with account management responsibilities
system/network administrators
personnel with information security responsibilities

Test

Mechanisms implementing account management functions

03.01.09E Attribute-Based Access Control – Assessment Procedure

Assessment Objective

Determine if:

the attribute-based access control policy is enforced over defined subjects.
the attribute-based access control policy is enforced over defined objects.
access is controlled based upon [Assignment: attributes] .

Assessment Methods

Examine

Access control policy
procedures addressing access enforcement
system design documentation
system configuration settings and associated documentation
list of subjects and objects (i.e., users and resources) requiring enforcement of attribute-based access control policies
system audit records
system security plan
other relevant documents or records

Interview

Personnel with access enforcement responsibilities
system/network administrators
personnel with information security responsibilities

Test

Mechanisms implementing access enforcement functions

03.01.10E Object Security Attributes – Assessment Procedure

Assessment Objective

Determine if:

[Assignment: security attributes] associated with [Assignment: information objects], [Assignment: source objects], and [Assignment: destination objects] are used to enforce [Assignment: information flow control policies] as a basis for flow control decisions.

Assessment Methods

Examine

Access control policy
information flow control policies
procedures addressing information flow enforcement
system design documentation
system configuration settings and associated documentation
list of security attributes and associated source and destination objects
system audit records
system security plan
other relevant documents or records

Interview

System/network administrators
personnel with information security responsibilities
system developers

Test

Mechanisms implementing information flow enforcement policy

03.01.11E Role-Based Access Control – Assessment Procedure

Assessment Objective

Determine if:

a role-based access control policy over defined subjects and objects is enforced.
access is controlled based upon [Assignment: organization-defined roles and users authorized to assume such roles] .

Assessment Methods

Examine

Access control policy
role-based access control policies
procedures addressing access enforcement
system design documentation
system configuration settings and associated documentation
list of roles, users, and associated privileges required to control system access
system audit records
system security plan
other relevant documents or records

Interview

Organizational personnel with access enforcement responsibilities
system/network administrators
organizational personnel with information security responsibilities
system developers

Test

Mechanisms implementing role-based access control policy

03.01.12E Physical or Logical Separation of CUI Flows – Assessment Procedure

Assessment Objective

Determine if:

CUI flows are logically or physically separated using [Assignment: organization-defined mechanisms and/or techniques].

Assessment Methods

Examine

Information flow enforcement policy
information flow control policies
procedures addressing information flow enforcement
system design documentation
system configuration settings and associated documentation
list of required separation of information flows by information types
list of mechanisms and/or techniques used to logically or physically separate information flows
system audit records
system security plan
other relevant documents or records

Interview

Organizational personnel with information flow enforcement responsibilities
system/network administrators
organizational personnel with information security responsibilities
system developers

Test

Mechanisms implementing information flow enforcement functions

03.01.13E Metadata – Assessment Procedure

Assessment Objective

Determine if:

information flow control based on [Assignment: metadata] is enforced.

Assessment Methods

Examine

Access control policy
information flow control policies
procedures addressing information flow enforcement
system design documentation
system configuration settings and associated documentation
system audit records
system security plan
other relevant documents or records

Interview

System/network administrators
organizational personnel with information security responsibilities
system developers

Test

Mechanisms implementing information flow enforcement policy

03.01.14E Security Policy Filters – Assessment Procedure

Assessment Objective

Determine if:

information flow control is enforced using [Assignment: organization-defined security policy filters] as a basis for flow control decisions for [Assignment: organization-defined information flows].
[Assignment: SELECTED PARAMETER VALUE(S)] data after a filter processing failure in accordance with [Assignment: organization-defined security policy].

Assessment Methods

Examine

Access control policy
information flow control policies
procedures addressing information flow enforcement
system design documentation
system configuration settings and associated documentation
list of security policy filters regulating flow control decisions
system audit records
system security plan
other relevant documents or records

Interview

System/network administrators
organizational personnel with information security responsibilities
system developers

Test

Mechanisms implementing information flow enforcement policy
security policy filters

03.01.15E Data Type Identifiers – Assessment Procedure

Assessment Objective

Determine if:

when transferring information between security domains, [Assignment: data type identifiers] are used to validate data that is essential for information flow decisions.

Assessment Methods

Examine

Access control policy
information flow control policies
procedures addressing information flow enforcement
system design documentation
system configuration settings and associated documentation
list of data type identifiers
system audit records
system security plan
other relevant documents or records

Interview

System/network administrators
organizational personnel with information security responsibilities
system developers

Test

Mechanisms implementing information flow enforcement policy

03.01.16E Decomposition Into Policy-Relevant Subcomponents – Assessment Procedure

Assessment Objective

Determine if:

when transferring information between different security domains, CUI is decomposed into [Assignment: policy-relevant subcomponents] for submission to policy enforcement mechanisms

Assessment Methods

Examine

Access control policy
information flow control policies
procedures addressing information flow enforcement
system design documentation
system configuration settings and associated documentation
system audit records
system security plan
other relevant documents or records

Interview

System/network administrators
personnel with information security responsibilities
system developers

Test

Mechanisms implementing information flow enforcement policy

03.01.17E Detection of Unsanctioned CUI – Assessment Procedure

Assessment Objective

Determine if:

when transferring information between different security domains, information is examined for the presence of [Assignment: organization-defined unsanctioned information] .
the transfer of CUI defined in 03.01.17E.a is prohibited in accordance with [Assignment: organization-defined security policy].

Assessment Methods

Examine

Access control policy
information flow control policies
procedures addressing information flow enforcement
system design documentation
system configuration settings and associated documentation
list of unsanctioned information types and associated information
system audit records
system security plan
other relevant documents or records

Interview

Organizational personnel with information security responsibilities
system developers

Test

Mechanisms implementing information flow enforcement policy

03.02.01E Advanced Literacy and Awareness Training – Assessment Procedure

Assessment Objective

Determine if:

security literacy training on the advanced persistent threat is provided to system users.
security literacy training on recognizing suspicious communications and anomalous behavior in systems using [Assignment: indicators of malicious code] is provided to system users.
security literacy training on the cyber threat environment is provided to system users.
security literacy training content is updated [Assignment: frequency].
security literacy training content is updated following [Assignment: events]

Assessment Methods

Examine

System security plan
security literacy and awareness training policy
procedures addressing security literacy and awareness training implementation
security literacy and awareness training curriculum
security literacy and awareness training materials
other relevant documents or records

Interview

Personnel who receive security literacy and awareness training
personnel with responsibilities for security literacy and awareness training
personnel with information security responsibilities

03.02.02E Literacy and Awareness Training Practical Exercises – Assessment Procedure

Assessment Objective

Determine if:

practical exercises in literacy training that simulate events and incidents are provided.

Assessment Methods

Examine

System security plan
security literacy and awareness training policy
procedures addressing security literacy and awareness training implementation
security awareness training curriculum
security awareness training materials
other relevant documents or records

Interview

Personnel who receive security literacy and awareness training
personnel with responsibilities for security awareness training
personnel with information security responsibilities

Test

Mechanisms implementing cyber-attack simulations in practical exercises

03.02.03E Literacy and Awareness Training Feedback – Assessment Procedure

Assessment Objective

Determine if:

feedback on organizational training results is provided to [Assignment: personnel].

Assessment Methods

Examine

Security awareness training policy
procedures addressing security literacy and awareness training records
security literacy and awareness training records
security plan
other relevant documents or records

Interview

Personnel with security and awareness training record retention responsibilities

Test

Mechanisms supporting the management of security literacy and awareness training records

03.02.04E Anti-Counterfeit Training – Assessment Procedure

Assessment Objective

Determine if:

[Assignment: personnel or roles] are trained to detect counterfeit system components.

Assessment Methods

Examine

Supply chain risk management policy and procedures
supply chain risk management plan
system and services acquisition policy
anti-counterfeit plan
anti-counterfeit policy and procedures
media disposal policy
media protection policy
incident response policy
training materials addressing counterfeit system components
training records on the detection and prevention of counterfeit components entering the system
system security plan
other relevant documents or records

Interview

Personnel with information security responsibilities
personnel with supply chain risk management responsibilities
personnel with contract management responsibilities
personnel with personnel with responsibilities for anti-counterfeit policies, procedures, and training

Test

Processes for anti-counterfeit training

03.03.01E Protection of Audit Record Storage in Separate Physical Systems or Components – Assessment Procedure

Assessment Objective

Determine if:

audit records are stored in a repository that is part of a physically different system or system component than the system or component being audited.

Assessment Methods

Examine

Audit and accountability policy
system security plan
procedures addressing protection of audit information
system design documentation
system configuration settings and associated documentation
system or media storing backups of system audit records
system audit records
other relevant documents or records

Interview

Personnel with audit and accountability responsibilities
personnel with information security responsibilities
system/network administrators
system developers

Test

Mechanisms implementing the backing up of audit records

03.03.02E Real-Time Alerts for Audit Processing Failures – Assessment Procedure

Assessment Objective

Determine if:

an alert is provided within [Assignment: real-time period] to [Assignment: personnel, roles, and/or locations] when [Assignment: audit logging failure events] occur.

Assessment Methods

Examine

Audit and accountability policy
procedures addressing response to audit processing failures
system design documentation
system security plan
system configuration settings and associated documentation
system audit records
other relevant documents or records

Interview

Personnel with audit and accountability responsibilities
personnel with information security responsibilities
system/network administrators
system developers

03.03.03E Dual Authorization for Audit Information and Actions – Assessment Procedure

Assessment Objective

Determine if:

dual authorization is enforced for the [Assignment: SELECTED PARAMETER VALUE(S)] of [Assignment: audit information].

Assessment Methods

Examine

Audit and accountability policy
system security plan
access control policy and procedures
procedures addressing protection of audit information
system design documentation
system configuration settings and associated documentation
access authorizations
system audit records
other relevant documents or records

Interview

Personnel with audit and accountability responsibilities
personnel with information security responsibilities
system/network administrators

Test

Mechanisms implementing the enforcement of dual authorization

03.03.04E Integrated Analysis of Audit Records – Assessment Procedure

Assessment Objective

Determine if:

analysis of audit records is integrated with analysis of [Assignment: SELECTED PARAMETER VALUE(S)] to further enhance the ability to identify inappropriate or unusual activity.

Assessment Methods

Examine

Audit and accountability policy
system security plan
procedures addressing audit review, analysis, and reporting
system design documentation
system configuration settings and associated documentation
integrated analysis of audit records, vulnerability scanning information, performance data, network monitoring information and associated documentation
other relevant documents or records

Interview

Personnel with audit review, analysis, and reporting responsibilities
personnel with information security responsibilities

Test

Mechanisms implementing the capability to integrate analysis of audit records with analysis of data or information sources

03.04.02E Automated Unauthorized Component Detection – Assessment Procedure

Assessment Objective

Determine if:

the presence of unauthorized or misconfigured system components is detected using [Assignment: automated mechanisms].
one or more of the following actions is/are taken when unauthorized or misconfigured system components are detected: [Assignment: SELECTED PARAMETER VALUE(S)].

Assessment Methods

Examine

Configuration management policy
procedures addressing system component inventory and configuration settings
configuration management plan
system configuration settings and associated documentation
system component inventory
system design documentation
change control records
common secure configuration checklists
alerts or notifications of unauthorized components within the system
system monitoring records
system maintenance records
system audit records
system security plan
other relevant documents or records

Interview

Personnel with component inventory and security configuration management responsibilities
personnel with responsibilities for managing automated mechanisms implementing unauthorized system component detection
personnel with information security responsibilities
system/network administrators
system developers

Test

Processes for the detection of unauthorized or misconfigured system components
automated processes for taking action when unauthorized or misconfigured system components are detected
automated mechanisms supporting and/or implementing the detection of unauthorized or misconfigured system components
automated mechanisms supporting and/or implementing actions taken when unauthorized or misconfigured system components are detected

03.04.03E Automated Maintenance of System Component Inventory – Assessment Procedure

Assessment Objective

Determine if:

[Assignment: automated mechanisms] are used to maintain the currency of the system component inventory.
[Assignment: automated mechanisms] are used to maintain the completeness of the system component inventory.
[Assignment: automated mechanisms] are used to maintain the accuracy of the system component inventory.
[Assignment: automated mechanisms] are used to maintain the availability of the system component inventory.

Assessment Methods

Examine

Configuration management policy
procedures addressing system component inventory
configuration management plan
system security plan
system design documentation
system component inventory
change control records
system maintenance records
system audit records
other relevant documents or records

Interview

Personnel with component inventory management responsibilities
personnel with information security responsibilities
system developers
system/network administrators

Test

Processes for maintaining the system component inventory
automated mechanisms supporting and/or implementing the system component inventory

03.04.04E Automation Support for Baseline Configuration – Assessment Procedure

Assessment Objective

Determine if:

the currency of the baseline configuration of the system is maintained using [Assignment: automated mechanisms].
the completeness of the baseline configuration of the system is maintained using [Assignment: automated mechanisms].
the accuracy of the baseline configuration of the system is maintained using [Assignment: automated mechanisms].
the availability of the baseline configuration of the system is maintained using [Assignment: automated mechanisms].

Assessment Methods

Examine

Configuration management policy
procedures addressing the baseline configuration of the system
configuration management plan
system design documentation
system architecture and configuration documentation
system configuration settings and associated documentation
system component inventory
configuration change control records
system security plan
other relevant documents or records

Interview

Personnel with configuration management responsibilities
personnel with information security responsibilities
system/network administrators

Test

Processes for managing baseline configurations
automated mechanisms implementing baseline configuration maintenance

03.04.05E Dual Authorization for System Changes – Assessment Procedure

Assessment Objective

Determine if:

dual authorization for implementing changes to [Assignment: system components] is enforced.
dual authorization for implementing changes to [Assignment: system-level information] is enforced.

Assessment Methods

Examine

Configuration management policy
procedures addressing access restrictions for changes to the system
configuration management plan
system design documentation
system architecture and configuration documentation
system configuration settings and associated documentation
change control records
system audit records
system component inventory
system information types
system security plan
other relevant documents or records

Interview

Personnel with dual authorization enforcement responsibilities for implementing system changes
personnel with information security responsibilities
system/network administrators

Test

Processes for managing access restrictions to change
mechanisms implementing dual authorization enforcement

03.04.06E Retention of Previous Configurations – Assessment Procedure

Assessment Objective

Determine if:

[Assignment: number] previous versions of baseline configurations of the system are retained to support rollback.

Assessment Methods

Examine

Configuration management policy
procedures addressing the baseline configuration of the system
configuration management plan
system architecture and configuration documentation
system configuration settings and associated documentation
copies of previous baseline configuration versions
system security plan
other relevant documents or records

Interview

Personnel with configuration management responsibilities
personnel with information security responsibilities
system/network administrators

Test

Processes for managing baseline configurations

03.04.07E Testing, Validation, and Documentation of Changes – Assessment Procedure

Assessment Objective

Determine if:

changes to the system are tested before finalizing the implementation of the changes.
changes to the system are validated before finalizing the implementation of the changes.
changes to the system are documented before finalizing the implementation of the changes.

Assessment Methods

Examine

Configuration management policy
configuration management plan
procedures addressing system configuration change control
system architecture and configuration documentation
system design documentation
test records
system configuration settings and associated documentation
validation records
change control records
system audit records
system security plan
other relevant documents or records

Interview

Personnel with configuration change control responsibilities
personnel with information security responsibilities
members of change control board or similar
system/network administrators
system developers

Test

Processes for configuration change control
mechanisms supporting and/or implementing, testing, validating, and documenting system changes

03.04.08E Centralized Repository – Assessment Procedure

Assessment Objective

Determine if:

a centralized repository for the inventory of system components is provided.

Assessment Methods

Examine

Configuration management policy
procedures addressing system component inventory
configuration management plan
system design documentation
system security plan
system component inventory
system configuration settings and associated documentation
change control records
system security plan
other relevant documents or records

Interview

Organizational personnel with component inventory management responsibilities
organizational personnel with security responsibilities

Test

Organizational processes for managing the system component inventory
mechanisms supporting and/or implementing system component inventory

03.05.01E Cryptographic Bidirectional Authentication – Assessment Procedure

Assessment Objective

Determine if:

[Assignment: devices and/or types of devices] are authenticated before establishing a system connection using bidirectional authentication that is cryptographically based.

Assessment Methods

Examine

Identification and authentication policy
system security plan
procedures addressing device identification and authentication
system design documentation
configuration settings and associated documentation
list of devices requiring unique identification and authentication
device connection reports
other relevant documents or records

Interview

Personnel with operational responsibilities for device identification and authentication
personnel with information security responsibilities
system/network administrators
system developers

Test

Mechanisms supporting and/or implementing device authentication capabilities
cryptographically based bidirectional authentication mechanisms

03.05.02E Password Managers – Assessment Procedure

Assessment Objective

Determine if:

[Assignment: password managers] are employed to generate and manage passwords.
passwords are protected using [Assignment: safeguards] .

Assessment Methods

Examine

Identification and authentication policy
procedures addressing identifier management
system security plan
system design documentation
mechanisms providing dynamic binding of identifiers and authenticators
system configuration settings and associated documentation
system audit records
other relevant documents or records

Interview

Personnel with identification and authentication management responsibilities
personnel with information security responsibilities
system/network administrators

Test

Mechanisms supporting and/or implementing account management capabilities
mechanisms supporting and/or implementing identification and authentication management capabilities for the system

03.05.03E Device Attestation – Assessment Procedure

Assessment Objective

Determine if:

device identification and authentication are handled based on attestation by [Assignment: organization-defined configuration management process].

Assessment Methods

Examine

Identification and authentication policy
system security plan
procedures addressing device identification and authentication
procedures addressing device configuration management
system design documentation
system configuration settings and associated documentation
configuration management records
change control records
system audit records
other relevant documents or records

Interview

Personnel with operational responsibilities for device identification and authentication
personnel with information security responsibilities
system/network administrators

Test

Mechanisms supporting and/or implementing device identification and authentication capabilities
mechanisms supporting and/or implementing configuration management
cryptographic mechanisms supporting device attestation

03.05.04E No Embedded Unencrypted Static Authenticators – Assessment Procedure

Assessment Objective

Determine if:

unencrypted static authenticators are not embedded in applications or other forms of static storage.

Assessment Methods

Examine

Identification and authentication policy
system security plan
procedures addressing authenticator management
system design documentation
system configuration settings and associated documentation
logical access scripts
application code reviews for detecting unencrypted static authenticators
other relevant documents or records

Interview

Personnel with authenticator management responsibilities
personnel with information security responsibilities
system/network administrators
system developers

Test

Mechanisms supporting and/or implementing authenticator management capabilities
mechanisms implementing authentication in applications

03.05.05E Expiration of Cached Authenticators – Assessment Procedure

Assessment Objective

Determine if:

the use of cached authenticators is prohibited after [Assignment: time period].

Assessment Methods

Examine

Identification and authentication policy
procedures addressing authenticator management
system security plan
system design documentation
system configuration settings and associated documentation
system audit records
other relevant documents or records

Interview

Personnel with authenticator management responsibilities
personnel with information security responsibilities
system/network administrators
system developers

Test

Mechanisms supporting and/or implementing authenticator management capabilities

03.05.06E Identity Proofing – Assessment Procedure

Assessment Objective

Determine if:

users who require accounts for logical access to systems based on appropriate identity assurance level requirements as specified in applicable standards and guidelines are identity-proofed.
user identities are resolved to a unique individual.
identity evidence is collected.
identity evidence is validated.
identity evidence is verified.

Assessment Methods

Examine

Identification and authentication policy
procedures addressing identity proofing
system security plan
other relevant documents or records

Interview

Personnel with system operations responsibilities
personnel with information security responsibilities
system/network administrators
system developers
personnel with identification and authentication responsibilities

Test

Mechanisms supporting and/or implementing identification and authentication capabilities

03.05.07E Identity Providers and Authorization Servers – Assessment Procedure

Assessment Objective

Determine if:

identity providers are employed to manage user, device, and non-person entity identities, attributes, and access rights supporting authentication decisions in accordance with [Assignment: policy] using [Assignment: mechanisms].
identity providers are employed to manage user, device, and non-person entity identities, attributes, and access rights supporting authorization decisions in accordance with [Assignment: policy] using [Assignment: mechanisms].
authorization servers are employed to manage user, device, and non-person entity identities, attributes, and access rights supporting authentication decisions in accordance with [Assignment: policy] using [Assignment: mechanisms].

Assessment Methods

Examine

Identification and authentication policy
procedures addressing user and device identification and authentication
system security plan
system design documentation
system configuration settings and associated documentation
other relevant documents or records

Interview

Organizational personnel with system operations responsibilities
organizational personnel with information security responsibilities
system/network administrators
organizational personnel with account management responsibilities
system developers

Test

Mechanisms supporting and/or implementing identification and authentication capabilities and access rights

03.06.01E Security Operations Center – Assessment Procedure

Assessment Objective

Determine if:

a security operations center is established.
a security operations center is maintained.

Assessment Methods

Examine

Incident response policy
contingency planning policy
procedures addressing incident handling
procedures addressing the security operations center operations
mechanisms supporting dynamic response capabilities
system security plan
contingency plan
incident response plan
other relevant documents or records

Interview

Personnel with incident handling responsibilities
personnel with information security responsibilities
security operations center personnel
personnel with contingency planning responsibilities

Test

Mechanisms that support and/or implement the security operations center capability
mechanisms that support and/or implement the incident handling process

03.06.02E Integrated Incident Response Team – Assessment Procedure

Assessment Objective

Determine if:

an integrated incident response team is established.
an integrated incident response team is maintained.
the integrated incident response team can be deployed to any location identified by the organization in [Assignment: time period].

Assessment Methods

Examine

Incident response policy
procedures addressing incident handling
procedures addressing incident response planning
incident response plan
system security plan
other relevant documents or records

Interview

Personnel with incident handling responsibilities
personnel with information security responsibilities
members of the integrated incident response team

03.06.03E Behavior Analysis – Assessment Procedure

Assessment Objective

Determine if:

anomalous or suspected adversarial behavior in or related to [Assignment: environments or resources] is analyzed.

Assessment Methods

Examine

Incident response policy
procedures addressing system monitoring tools and techniques
incident response plan
system monitoring logs or records
system monitoring tools and techniques documentation
system configuration settings and associated documentation
system security plan
system component inventory
network diagram
system protocols documentation
list of acceptable thresholds for false positives and false negatives
other relevant documents or records

Interview

Personnel with information security responsibilities
system/network administrators

Test

Processes for detecting anomalous behavior

03.06.04E Automated Tracking, Data Collection, and Analysis for Incident Monitoring – Assessment Procedure

Assessment Objective

Determine if:

incidents are tracked using [Assignment: automated mechanisms].
incident information is collected using [Assignment: automated mechanisms].
incident information is analyzed using [Assignment: automated mechanisms].

Assessment Methods

Examine

Incident response policy
procedures addressing incident monitoring
incident response records and documentation
system security plan
incident response plan
other relevant documents or records

Interview

Personnel with incident monitoring responsibilities
personnel with information security responsibilities

Test

Incident monitoring capability for the organization
automated mechanisms supporting and/or implementing the tracking and documenting of system security incidents

03.07.01E Software Updates and Patches for Maintenance Tools – Assessment Procedure

Assessment Objective

Determine if:

maintenance tools are inspected to ensure that the latest software updates and patches are installed.

Assessment Methods

Examine

Maintenance policy
procedures addressing system maintenance tools
system maintenance tools and associated documentation
list of personnel authorized to use maintenance tools
maintenance tool usage records
maintenance records
system security plan
other relevant documents or records

Interview

Personnel with system maintenance responsibilities
personnel with information security responsibilities

Test

Processes for inspecting maintenance tools
processes for maintenance tool updates
mechanisms supporting and/or implementing the inspection of maintenance tools
mechanisms supporting and/or implementing maintenance tool updates

03.08.01E Dual Authorization for Media Sanitization – Assessment Procedure

Assessment Objective

Determine if:

dual authorization for the sanitization of [Assignment: system media] is enforced.

Assessment Methods

Examine

System media protection policy
procedures addressing media sanitization and disposal
dual authorization policy and procedures
list of system media requiring dual authorization for sanitization
authorization records
media sanitization records
audit records
system security plan
other relevant documents or records

Interview

Personnel with system media sanitization responsibilities
personnel with information security responsibilities
system/network administrators

Test

Processes requiring dual authorization for media sanitization
mechanisms supporting and/or implementing media sanitization
mechanisms supporting and/or implementing dual authorization

03.08.02E Dual Authorization for System Backup Deletion and Destruction – Assessment Procedure

Assessment Objective

Determine if:

dual authorization for the deletion or destruction of [Assignment: system backup information] is enforced.

Assessment Methods

Examine

Contingency planning policy
procedures addressing system backup
contingency plan
system design documentation
system configuration settings and associated documentation
system-generated list of dual authorization credentials or rules
logs or records of the deletion or destruction of backup information
system security plan
other relevant documents or records

Interview

Personnel with system backup responsibilities
personnel with information security responsibilities

Test

Mechanisms supporting and/or implementing dual authorization
mechanisms supporting and/or implementing the deletion and/or destruction of backup information

03.08.03E Testing System Backups for Reliability and Integrity – Assessment Procedure

Assessment Objective

Determine if:

backup information is tested [Assignment: frequency] to verify media reliability.
backup information is tested [Assignment: frequency] to verify information integrity.

Assessment Methods

Examine

Contingency planning policy
procedures addressing system backup
contingency plan
system backup test results
contingency plan test documentation
contingency plan test results
system security plan
other relevant documents or records

Interview

Personnel with system backup responsibilities
personnel with information security responsibilities

Test

Processes for conducting system backups
mechanisms supporting and/or implementing system backups

03.08.04E System Recovery and Reconstitution – Assessment Procedure

Assessment Objective

Determine if:

the recovery of the system to a known state is provided within [Assignment: time period] after a disruption, compromise, or failure.
the reconstitution of the system to a known state is provided within [Assignment: time period] after a disruption, compromise, or failure.

Assessment Methods

Examine

Contingency planning policy
procedures addressing system backup
contingency plan
system backup test results
contingency plan test results
contingency plan test documentation
redundant secondary system for system backups
locations of redundant secondary backup systems
system security plan
other relevant documents or records

Interview

Organizational personnel with contingency planning, recovery, and/or reconstitution responsibilities
organizational personnel with information security responsibilities

Test

Organizational processes implementing system recovery and reconstitution operations
mechanisms supporting and/or implementing system recovery and reconstitution operations

03.09.03E Access Agreements – Assessment Procedure

Assessment Objective

Determine if:

access agreements are developed and documented for systems processing, storing, or transmitting CUI.
access agreements are reviewed [Assignment: frequency] .
access agreements are updated [Assignment: frequency] .
individuals requiring access to CUI and systems processing, storing, or transmitting CUI sign appropriate access agreements prior to being granted access.
individuals requiring access to CUI and systems processing, storing, or transmitting CUI re-sign access agreements to maintain access when access agreements have been updated or [Assignment: frequency] .

Assessment Methods

Examine

Personnel security policy
personnel security procedures
procedures addressing access agreements for systems processing, storing, or transmitting CUI
access control policy
access control procedures
access agreements (including non-disclosure agreements, acceptable use agreements, rules of behavior, and conflict-of-interest agreements)
documentation of access agreement reviews, updates, and re-signing
system security plan
other relevant documents or records

Interview

Personnel with personnel security responsibilities
personnel who have signed and/or resigned access agreements
personnel with information security responsibilities

Test

Processes for reviewing, updating, and re-signing access agreements
mechanisms supporting reviewing, updating, and re-signing of access agreements

03.09.04E Citizenship Requirements – Assessment Procedure

Assessment Objective

Determine if:

individuals accessing a system processing, storing, or transmitting CUI meet [Assignment: organization-defined citizenship requirements].

Assessment Methods

Examine

Personnel security policy
access control policy, procedures addressing personnel screening
records of screened personnel
screening criteria
records of access authorizations
system security plan
other relevant documents or records

Interview

Personnel with personnel security responsibilities
personnel with information security responsibilities

Test

Processes for ensuring valid access authorizations for accessing CUI and systems requiring citizenship
processes for additional personnel screening

03.10.01E Intrusion Alarms and Surveillance Equipment – Assessment Procedure

Assessment Objective

Determine if:

physical access to the facility where the system resides is monitored using physical intrusion alarms.
physical access to the facility where the system resides is monitored using physical surveillance equipment.

Assessment Methods

Examine

Physical and environmental protection policy
procedures addressing physical access monitoring
physical access monitoring records
physical access log reviews
physical access logs or records
system security plan
other relevant documents or records

Interview

Personnel with physical access monitoring responsibilities
personnel with incident response responsibilities
personnel with information security responsibilities

Test

Processes for monitoring physical intrusion alarms and surveillance equipment
mechanisms supporting and/or implementing physical intrusion alarms and surveillance equipment
mechanisms supporting and/or implementing physical access monitoring

03.10.02E Delivery and Removal of System Components – Assessment Procedure

Assessment Objective

Determine if:

[Assignment: types of system components] are authorized when entering the facility.
[Assignment: types of system components] are controlled when entering the facility.
[Assignment: types of system components] are authorized when exiting the facility.
[Assignment: types of system components] are controlled when exiting the facility.
records of the system components entering and exiting the facility are maintained.

Assessment Methods

Examine

Physical and environmental protection policy
procedures addressing the delivery and removal of system components from the facility
facility housing the system
records of items entering and exiting the facility
system security plan
other relevant documents or records

Interview

Personnel with responsibilities for controlling system components entering and exiting the facility
personnel with information security responsibilities

Test

Process for authorizing, monitoring, and controlling system-related items entering and exiting the facility
mechanisms supporting and/or implementing, authorizing, monitoring, and controlling system components entering and exiting the facility

03.11.01E Threat Awareness Program – Assessment Procedure

Assessment Objective

Determine if:

a threat awareness program that includes a cross-organization information-sharing capability for threat intelligence is implemented.

Assessment Methods

Examine

Information security program plan
threat awareness program policy
threat awareness program procedures
risk assessment results relevant to threat awareness
documentation about the cross-organization information-sharing capability
other relevant documents or records

Interview

Personnel with information security program planning and plan implementation responsibilities
personnel responsible for the threat awareness program
personnel responsible for the cross-organization information-sharing capability
personnel with information security responsibilities
external personnel with whom threat awareness information is shared by the organization

Test

Processes for implementing the threat awareness program
processes for implementing the cross-organization information-sharing capability
mechanisms supporting and/or implementing the threat awareness program
mechanisms supporting and/or implementing the cross-organization information-sharing capability

03.11.02E Threat Hunting – Assessment Procedure

Assessment Objective

Determine if:

a cyber threat-hunting capability is established to search for indicators of compromise in organizational systems.
a cyber threat-hunting capability is maintained to search for indicators of compromise in organizational systems.
a cyber threat-hunting capability is established to detect, track, and disrupt threats that evade existing safeguards.
a cyber threat-hunting capability is maintained to detect, track, and disrupt threats that evade existing safeguards.
the threat-hunting capability is employed[Assignment: frequency].

Assessment Methods

Examine

Risk assessment policy
assessment reports
audit records and/or event logs
threat-hunting capability
system security plan
other relevant documents or records

Interview

Personnel with threat-hunting responsibilities
system/network administrators
personnel with information security responsibilities

Test

Processes for assessments and audits
mechanisms or tools supporting and/or implementing threat-hunting capabilities

03.11.03E Predictive Cyber Analytics – Assessment Procedure

Assessment Objective

Determine if:

[Assignment: advanced automation capabilities] are employed to predict and identify risks to [Assignment: systems or system components].
[Assignment: advanced analytics capabilities] are employed to predict and identify risks to [Assignment: systems or system components].

Assessment Methods

Examine

Risk assessment policy
security planning policy and procedures
procedures addressing organizational assessments of risk
risk assessment
risk assessment results
risk assessment reviews
risk assessment updates
risk reports
system security plan
other relevant documents or records

Interview

Personnel with risk assessment responsibilities
personnel with information security responsibilities

Test

Processes for risk assessment
mechanisms supporting and/or conducting, documenting, reviewing, disseminating, and updating the risk assessment

03.11.08E Dynamic Threat Awareness – Assessment Procedure

Assessment Objective

Determine if:

the current cyber threat environment is determined on an ongoing basis using [Assignment: means].

Assessment Methods

Examine

Risk assessment policy
security planning policy and procedures
procedures addressing organizational assessments of risk
risk assessment
risk assessment results
risk assessment reviews
risk assessment updates
risk reports
system security plan
other relevant documents or records

Interview

Personnel with risk assessment responsibilities
personnel with information security responsibilities

Test

Processes for risk assessment
mechanisms supporting and/or conducting, documenting, reviewing, disseminating, and updating the risk assessment

03.11.09E Indicators of Compromise – Assessment Procedure

Assessment Objective

Determine if:

indicators of compromise provided by [Assignment: sources] are discovered.
indicators of compromise provided by [Assignment: sources] are collected.
indicators of compromise provided by [Assignment: sources] are distributed to [Assignment: personnel or roles].

Assessment Methods

Examine

System and information integrity policy
system and information integrity procedures
procedures addressing system monitoring
system design documentation
system monitoring tools and techniques documentation
system configuration settings and associated documentation
system monitoring logs or records
system audit records
system security plan
other relevant documents or records

Interview

System/network administrators
personnel with information security responsibilities
system developers
personnel installing, configuring, and/or maintaining the system
personnel responsible for monitoring system hosts

Test

Processes for system monitoring
processes for the discovery, collection, distribution, and use of indicators of compromise
mechanisms supporting and/or implementing a system monitoring capability
mechanisms supporting and/or implementing the discovery, collection, distribution, and use of indicators of compromise

03.11.10E Criticality Analysis – Assessment Procedure

Assessment Objective

Determine if:

critical system components and functions are identified by performing a criticality analysis for [Assignment: systems, system components, or system services] at [Assignment: decision points].

Assessment Methods

Examine

Risk assessment policy
assessment reports
criticality analysis and/or finalized criticality for each component and/or subcomponent
audit records and/or event logs
analysis reports
system security plan
other relevant documents or records

Interview

Personnel with assessment and auditing responsibilities
personnel with criticality analysis responsibilities
system/network administrators
personnel with information security responsibilities

Test

Processes for assessments and audits
mechanisms and/or tools supporting and/or implementing assessments and auditing

03.11.11E Discoverable Information – Assessment Procedure

Assessment Objective

Determine if:

discoverable information about the system is identified.
[Assignment: corrective actions] are taken when information about the system is confirmed as discoverable.

Assessment Methods

Examine

Procedures addressing vulnerability scanning
assessment report
penetration test results
vulnerability scanning results
risk assessment report
records of corrective actions taken on discoverable information
incident response records
audit records
system security plan
other relevant documents or records

Interview

Personnel with vulnerability scanning and/or penetration testing responsibilities
personnel with vulnerability scan analysis responsibilities
personnel responsible for risk response
personnel responsible for incident management and response
personnel with information security responsibilities

Test

Processes for vulnerability scanning
processes for risk response
processes for incident management and response
mechanisms and/or tools supporting and/or implementing vulnerability scanning
mechanisms supporting and/or implementing risk response
mechanisms supporting and/or implementing incident management and response

03.11.12E Automated Means for Sharing Threat Intelligence – Assessment Procedure

Assessment Objective

Determine if:

automated mechanisms are employed to maximize the effectiveness of sharing threat intelligence information.

Assessment Methods

Examine

Information security program plan
threat awareness program policy
threat awareness program procedures
risk assessment results related to threat awareness
documentation about the cross-organization information-sharing capability
other relevant documents or records

Interview

Personnel with information security program planning and plan implementation responsibilities
personnel responsible for the threat awareness program
personnel responsible for the cross-organization information-sharing capability
personnel with information security responsibilities
external personnel with whom threat awareness information is shared by the organization

Test

Processes for implementing the threat awareness program
processes for implementing the cross-organization information-sharing capability
automated mechanisms supporting and/or implementing the threat awareness program
automated mechanisms supporting and/or implementing the cross-organization information-sharing capability

03.12.01E Penetration Testing – Assessment Procedure

Assessment Objective

Determine if:

penetration testing is conducted [Assignment: frequency] on [Assignment: systems or system components].

Assessment Methods

Examine

Assessment and monitoring policy
procedures addressing penetration testing
assessment plan
system security plan
penetration test rules of engagement
penetration test report
assessment report
assessment evidence
other relevant documents or records

Interview

Personnel with assessment responsibilities
personnel with information security responsibilities
system/network administrators

Test

Mechanisms supporting penetration testing

03.12.02E Independent Assessors – Assessment Procedure

Assessment Objective

Determine if:

independent assessors or assessment teams are used to conduct security requirement assessments.

Assessment Methods

Examine

Assessment and monitoring policy
procedures addressing assessments
previous assessment plan
previous assessment report
plan of action and milestones
system security plan
other relevant documents or records

Interview

Personnel with assessment responsibilities
personnel with information security responsibilities

03.12.03E Risk Monitoring – Assessment Procedure

Assessment Objective

Determine if:

risk monitoring is an integral part of the continuous monitoring strategy.
effectiveness monitoring is included in risk monitoring.
compliance monitoring is included in risk monitoring.
change monitoring is included in risk monitoring.

Assessment Methods

Examine

Assessment and monitoring policy
organizational continuous monitoring strategy
system-level continuous monitoring strategy
procedures addressing continuous monitoring of system
assessment report
plan of action and milestones
system monitoring records
impact analyses
status reports
system security plan
other relevant documents or records

Interview

Personnel with continuous monitoring responsibilities
personnel with information security responsibilities

Test

Mechanisms supporting risk monitoring

03.12.04E Internal System Connections – Assessment Procedure

Assessment Objective

Determine if:

internal connections of [Assignment: system components or classes of components] to the system are authorized.
for each internal connection, the interface characteristics are documented.
for each internal connection, the security requirements are documented.
for each internal connection, the nature of the information communicated is documented.
internal system connections are terminated after [Assignment: conditions].
the continued need for each internal connection is reviewed [Assignment: frequency].

Assessment Methods

Examine

Assessment and monitoring policy
access control policy
procedures addressing system connections
system and communications protection policy
system design documentation
system audit records
list of components or classes of components authorized as internal system connections
system security plan
system configuration settings and associated documentation
assessment report
other relevant documents or records

Interview

Personnel with responsibilities for developing, implementing, or authorizing internal system connections
personnel with information security and responsibilities

Test

Mechanisms supporting internal system connections

03.13.01E Heterogeneity – Assessment Procedure

Assessment Objective

Determine if:

a diverse set of information technologies is employed for [Assignment: system components] in the implementation of the system.

Assessment Methods

Examine

System and communications protection policy
system design documentation
system configuration settings and associated documentation
list of technologies deployed in the system
acquisition documentation
acquisition contracts for system components or services
system security plan
other relevant documents or records

Interview

System/network administrators
personnel with information security responsibilities
personnel with system acquisition, development, and implementation responsibilities

Test

Mechanisms supporting and/or implementing the use of a diverse set of information technologies

03.13.02E Randomness – Assessment Procedure

Assessment Objective

Determine if:

[Assignment: techniques] are employed to introduce randomness into organizational operations and assets.

Assessment Methods

Examine

System and communications protection policy
procedures addressing concealment and misdirection techniques for the system
system design documentation
system configuration settings and associated documentation
system architecture
list of techniques to be used to introduce randomness into organizational operations and assets
system audit records
system security plan
other relevant documents or records

Interview

System/network administrators
personnel with the responsibility to implement concealment and misdirection techniques for systems
personnel with information security responsibilities

Test

Mechanisms supporting and/or implementing randomness as a concealment and misdirection technique

03.13.03E Concealment and Misdirection – Assessment Procedure

Assessment Objective

Determine if:

[Assignment: concealment and misdirection techniques] are used to mislead adversaries.

Assessment Methods

Examine

System and communications protection policy
procedures addressing concealment and misdirection techniques for the system
system design documentation
system configuration settings and associated documentation
system architecture
list of concealment and misdirection techniques to be used for organizational systems
system audit records
system security plan
other relevant documents or records

Interview

System/network administrators
personnel with information security responsibilities
personnel with the responsibility to implement concealment and misdirection techniques for systems

Test

Mechanisms supporting and/or implementing concealment and misdirection techniques

03.13.04E Isolation of System Components – Assessment Procedure

Assessment Objective

Determine if:

boundary protection mechanisms are employed to isolate [Assignment: system components].

Assessment Methods

Examine

System and communications protection policy
procedures addressing boundary protection
system design documentation
system hardware and software
enterprise architecture documentation
system architecture
system configuration settings and associated documentation
system audit records
system security plan
other relevant documents or records

Interview

System/network administrators
personnel with information security responsibilities
personnel with boundary protection responsibilities

Test

Mechanisms supporting and/or implementing the capability to separate system components

03.13.05E Change Processing and Storage Locations – Assessment Procedure

Assessment Objective

Determine if:

the location of [Assignment: processing and/or storage] is changed [Assignment: SELECTED PARAMETER VALUE].

Assessment Methods

Examine

System and communications protection policy
configuration management policy and procedures
procedures addressing concealment and misdirection techniques for the system
list of processing and/or storage locations to be changed at organizational time intervals
change control records
configuration management records
system audit records
system security plan
other relevant documents or records

Interview

System/network administrators
personnel with information security responsibilities
personnel with the responsibility to change processing and/or storage locations

Test

Mechanisms supporting and/or implementing changing processing and/or storage locations

03.13.06E Platform-Independent Applications – Assessment Procedure

Assessment Objective

Determine if:

[Assignment: platform-independent applications] are implemented within organizational systems.

Assessment Methods

Examine

System and communications protection policy
procedures addressing platform-independent applications
system design documentation
system configuration settings and associated documentation
list of platform-independent applications
system audit records
system security plan
other relevant documents or records

Interview

System/network administrators
personnel with information security responsibilities
system developers

Test

Mechanisms supporting and/or implementing platform-independent applications

03.13.07E Virtualization Techniques – Assessment Procedure

Assessment Objective

Determine if:

virtualization techniques are employed to support the deployment of a diverse range of operating systems and applications that are changed [Assignment: frequency].

Assessment Methods

Examine

System and communications protection policy
configuration management policy and procedures
system design documentation
system configuration settings and associated documentation
system architecture
list of operating systems and applications deployed using virtualization techniques
change control records
configuration management records
system audit records
system security plan
other relevant documents or records

Interview

System/network administrators
personnel with information security responsibilities
personnel with responsibilities for implementing approved virtualization techniques to the system

Test

Mechanisms supporting and/or implementing the use of a diverse set of information technologies
mechanisms supporting and/or implementing virtualization techniques

03.13.08E Decoys – Assessment Procedure

Assessment Objective

Determine if:

components within organizational systems specifically designed to be the target of malicious attacks are included to detect such attacks.
components within organizational systems specifically designed to be the target of malicious attacks are included to deflect such attacks.
components within organizational systems specifically designed to be the target of malicious attacks are included to analyze such attacks.

Assessment Methods

Examine

System and communications protection policy
procedures addressing the use of decoys
system design documentation
system configuration settings and associated documentation
system audit records
system security plan
other relevant documents or records

Interview

System/network administrators
personnel with information security responsibilities
system developers

Test

Mechanisms supporting and/or implementing decoys

03.13.09E Isolation of Security Tools, Mechanisms, and Support Components – Assessment Procedure

Assessment Objective

Determine if:

[Assignment: information security tools, mechanisms, and support components] are isolated from other internal system components by implementing physically separate subnetworks with managed interfaces to other components of the system.

Assessment Methods

Examine

System and communications protection policy
procedures addressing boundary protection
system design documentation
system hardware and software
system architecture
system configuration settings and associated documentation
list of security tools and support components to be isolated from other internal system components
system audit records
system security plan
other relevant documents or records

Interview

System/network administrators
personnel with information security responsibilities
personnel with boundary protection responsibilities

Test

Mechanisms supporting and/or implementing the isolation of information security tools, mechanisms, and support components

03.13.10E Separate Subnetworks – Assessment Procedure

Assessment Objective

Determine if:

separate network addresses are implemented to connect to systems in different security domains.

Assessment Methods

Examine

System and communications protection policy
procedures addressing boundary protection
system design documentation
system hardware and software
system architecture
system configuration settings and associated documentation
system audit records
system security plan
other relevant documents or records

Interview

System/network administrators
personnel with information security responsibilities
system developers
personnel with boundary protection responsibilities

Test

Mechanisms supporting and/or implementing separate network addresses or different subnets

03.13.11E Thin Nodes – Assessment Procedure

Assessment Objective

Determine if:

minimal functionality for [Assignment: system components] is employed.
minimal information storage on [Assignment: system components] is employed.

Assessment Methods

Examine

System and communications protection policy
procedures addressing use of thin nodes
system design documentation
system configuration settings and associated documentation
system audit records
system security plan
other relevant documents or records

Interview

System/network administrators
personnel with information security responsibilities

Test

Mechanisms supporting and/or implementing thin nodes

03.13.12E Denial-of-Service Protection – Assessment Procedure

Assessment Objective

Determine if:

the effects of [Assignment: types of denial-of-service events] are [Assignment: SELECTED PARAMETER VALUE].
[Assignment: safeguards] are employed to protect against or limit the effects of denial-of-service events.

Assessment Methods

Examine

System and communications protection policy
procedures addressing denial-of-service protection
list of denial-of-service attacks requiring employment of security safeguards to protect against or limit effects of such attacks
system design documentation
list of security safeguards protecting against or limiting the effects of denial-of-service attacks
system configuration settings and associated documentation
system audit records
system security plan
other relevant documents or records

Interview

System/network administrators
personnel with information security responsibilities
personnel with incident response responsibilities
system developers

Test

Mechanisms protecting against or limiting the effects of denial-of-service attacks

03.13.13E Port and Input/Output Device Access – Assessment Procedure

Assessment Objective

Determine if:

[Assignment: connection ports or input/output devices] are [Assignment: SELECTED PARAMETER VALUE] disabled or removed on [Assignment: systems or system components].

Assessment Methods

Examine

System and communications protection policy
access control policy and procedures
procedures addressing port and input/output device access
system design documentation
system architecture
system configuration settings and associated documentation
systems or system components
list of connection ports or input/output devices to be physically disabled or removed on systems or system components
system security plan
other relevant documents or records

Interview

System/network administrators
personnel with information security responsibilities
personnel installing, configuring, and/or maintaining the system

Test

Mechanisms supporting and/or implementing the disabling of connection ports or input/output devices

03.13.14E Detonation Chambers – Assessment Procedure

Assessment Objective

Determine if:

a detonation chamber capability is employed within the [Assignment: system, system component, or location].

Assessment Methods

Examine

System and communications protection policy
procedures addressing detonation chambers
system configuration settings and associated documentation
system audit records
system design documentation
system security plan
other relevant documents or records

Interview

system/network administrators
personnel with information security responsibilities
personnel installing, configuring, and/or maintaining the system

Test

Mechanisms supporting and/or implementing the detonation chamber capability

03.13.15E Separate Subnets to Isolate System Components and Functions – Assessment Procedure

Assessment Objective

Determine if:

subnetworks are separated [Assignment: SELECTED PARAMETER VALUE] to isolate [Assignment: critical system components and functions].

Assessment Methods

Examine

System and communications protection policy
procedures addressing boundary protection
system design documentation
system hardware and software
system architecture
system configuration settings and associated documentation
criticality analysis
system audit records
system security plan
other relevant documents or records

Interview

System/network administrators
organizational personnel with information security responsibilities
system developer
organizational personnel with boundary protection responsibilities

Test

Mechanisms separating critical system components and functions

03.13.16E System Partitioning – Assessment Procedure

Assessment Objective

Determine if:

the system is partitioned into [Assignment: system components] residing in separate [Assignment: SELECTED PARAMETER VALUE] security domains or environments based on [Assignment: circumstances].

Assessment Methods

Examine

System and communications protection policy
procedures addressing system partitioning
system design documentation
system configuration settings and associated documentation
system architecture
list of system physical domains (or environments)
system facility diagrams
system network diagrams
system security plan
other relevant documents or records

Interview

System/network administrators
organizational personnel with information security responsibilities
organizational personnel installing, configuring, and/or maintaining the system
system developers/integrators

Test

Mechanisms supporting and/or implementing the physical separation of system components

03.14.01E Software, Firmware, and Information Integrity – Assessment Procedure

Assessment Objective

Determine if:

integrity verification tools are employed to detect unauthorized changes to [Assignment: software].
integrity verification tools are employed to detect unauthorized changes to [Assignment: firmware].
integrity verification tools are employed to detect unauthorized changes to [Assignment: information].
[Assignment: actions] are taken when unauthorized changes to software are detected.
[Assignment: actions] are taken when unauthorized changes to firmware are detected.
[Assignment: actions] are taken when unauthorized changes to information are detected.

Assessment Methods

Examine

System and information integrity policy
system and information integrity procedures
procedures addressing software, firmware, and information integrity
system configuration settings and associated documentation
integrity verification tools and associated documentation
records generated or triggered by system design documentation
integrity verification tools regarding unauthorized software, firmware, and information changes
system audit records
system security plan
other relevant documents or records

Interview

Personnel responsible for software, firmware, and/or information integrity
personnel with information security responsibilities
system/network administrators

Test

Software, firmware, and information integrity verification tools

03.14.04E Refresh From Trusted Sources – Assessment Procedure

Assessment Objective

Determine if:

the software and data used during system component and service refreshes are obtained from [Assignment: trusted sources].

Assessment Methods

Examine

System and information integrity policy
system and information integrity procedures
system design documentation
procedures addressing non-persistence for system components
system configuration settings and associated documentation
system audit records
system security plan
other relevant documents or records

Interview

Personnel responsible for obtaining component and service refreshes from trusted sources
personnel with information security responsibilities

Test

Processes for defining and obtaining component and service refreshes from trusted sources
automated mechanisms supporting and/or implementing component and service refreshes

03.14.05E Non-Persistent Information – Assessment Procedure

Assessment Objective

Determine if:

[Assignment: SELECTED PARAMETER VALUE] is performed.
information is deleted when no longer needed.

Assessment Methods

Examine

System and information integrity policy
system and information integrity procedures
system security plan
procedures addressing non-persistence for system components
system design documentation
system configuration settings and associated documentation
system audit records
other relevant documents or records

Interview

Personnel responsible for ensuring that information is and remains non-persistent
personnel with information security responsibilities

Test

Processes for ensuring that information is and remains non-persistent
automated mechanisms supporting and/or implementing component and service refreshes

03.14.08E Integrity Checks – Assessment Procedure

Assessment Objective

Determine if:

an integrity check of [Assignment: software] is performed [Assignment: SELECTED PARAMETER VALUE(S)].
an integrity check of [Assignment: firmware] is performed [Assignment: SELECTED PARAMETER VALUE(S)].
an integrity check of [Assignment: information] is performed [Assignment: SELECTED PARAMETER VALUE(S)].

Assessment Methods

Examine

System and information integrity policy
system and information integrity procedures
procedures addressing software, firmware, and information integrity testing
system design documentation
system configuration settings and associated documentation
system security plan
integrity verification tools and associated documentation
records of integrity scans
other relevant documents or records

Interview

Personnel responsible for software, firmware, and/or information integrity
personnel with information security responsibilities
system/network administrators
system developers

Test

Software, firmware, and information integrity verification tools

03.14.09E Cryptographic Protection – Assessment Procedure

Assessment Objective

Determine if:

cryptographic mechanisms are implemented to detect unauthorized changes to software.
cryptographic mechanisms are implemented to detect unauthorized changes to firmware.
cryptographic mechanisms are implemented to detect unauthorized changes to information.

Assessment Methods

Examine

System and information integrity policy
system and information integrity procedures
procedures addressing software, firmware, and information integrity
system design documentation
system configuration settings and associated documentation
system audit records
system security plan
cryptographic mechanisms and associated documentation
records of detected unauthorized changes to software, firmware, and information
other relevant documents or records

Interview

Personnel responsible for software, firmware, and/or information integrity
personnel with information security responsibilities
system/network administrators
system developers

Test

Software, firmware, and information integrity verification tools
cryptographic mechanisms implementing software, firmware, and information integrity

03.14.10E Protection of Boot Firmware – Assessment Procedure

Assessment Objective

Determine if:

[Assignment: mechanisms] are implemented to protect the integrity of boot firmware in [Assignment: system components].

Assessment Methods

Examine

System and information integrity policy
system and information integrity procedures
procedures addressing software, firmware, and information integrity
system design documentation
system configuration settings and associated documentation
system security plan
integrity verification tools and associated documentation
records of integrity verification scans
system audit records
other relevant documents or records

Interview

Personnel responsible for software, firmware, and/or information integrity
personnel with information security responsibilities
system/network administrators
system developer

Test

Software, firmware, and information integrity verification tools
mechanisms supporting and/or implementing protection of the integrity of boot firmware
safeguards implementing protection of the integrity of boot firmware

03.14.11E Integration of Detection and Response – Assessment Procedure

Assessment Objective

Determine if:

the detection of [Assignment: changes] are incorporated into the organizational incident response capability.

Assessment Methods

Examine

System and information integrity policy
system and information integrity procedures
procedures addressing software, firmware, and information integrity
procedures addressing incident response
system design documentation
system configuration settings and associated documentation
incident response records
audit records
system security plan
other relevant documents or records

Interview

Personnel responsible for software, firmware, and/or information integrity
personnel with information security responsibilities
personnel with incident response responsibilities

Test

Processes for incorporating the detection of unauthorized security-relevant changes into the incident response capability
mechanisms supporting and/or implementing the incorporation of detection of unauthorized security-relevant changes into the incident response capability
software, firmware, and information integrity verification tools

03.14.12E Information Input Validation – Assessment Procedure

Assessment Objective

Determine if:

the validity of the [Assignment: information inputs] is checked.

Assessment Methods

Examine

System and information integrity policy
system and information integrity procedures
access control policy and procedures
separation of duties policy and procedures
procedures addressing information input validation
documentation for automated tools and applications to verify the validity of information
list of information inputs requiring validity checks
system design documentation
system configuration settings and associated documentation
system audit records
system security plan
other relevant documents or records

Interview

Personnel responsible for information input validation
personnel with information security responsibilities
system/network administrators
system developers

Test

Mechanisms supporting and/or implementing validity checks on information inputs

03.14.13E Error Handling – Assessment Procedure

Assessment Objective

Determine if:

error messages that provide the information necessary for corrective actions are generated without revealing information that could be exploited.
error messages are revealed only to [Assignment: personnel or roles].

Assessment Methods

Examine

System and information integrity policy
system and information integrity procedures
procedures addressing system error handling
system design documentation
system configuration settings and associated documentation
documentation providing the structure and content of error messages
system audit records
system security plan
other relevant documents or records

Interview

Personnel responsible for information input validation
personnel with information security responsibilities
system/network administrators
system developers

Test

Processes for error handling
automated mechanisms supporting and/or implementing error handling
automated mechanisms supporting and/or implementing the management of error messages

03.14.14E Memory Protection – Assessment Procedure

Assessment Objective

Determine if:

[Assignment: safeguards] are implemented to protect the system memory from unauthorized code execution.

Assessment Methods

Examine

System and information integrity policy
system and information integrity procedures
procedures addressing memory protection for the system
system design documentation
system configuration settings and associated documentation
list of security safeguards protecting system memory from unauthorized code execution
system audit records
system security plan
other relevant documents or records

Interview

Personnel responsible for memory protection
personnel with information security responsibilities
system/network administrators
system developers

Test

Automated mechanisms supporting and/or implementing safeguards to protect the system memory from unauthorized code execution

03.14.15E Non-Persistent System Components and Services – Assessment Procedure

Assessment Objective

Determine if:

[Assignment: non-persistent system components and services] are implemented.
[Assignment: non-persistent system components and services] are initiated from a known state.
[Assignment: non-persistent system components and services] are terminated [Assignment: SELECTED PARAMETER VALUE(S)].

Assessment Methods

Examine

System and information integrity policy
system and information integrity procedures
system design documentation
procedures addressing non-persistence for system components
system security plan
system configuration settings and associated documentation
system audit records
other relevant documents or records

Interview

Personnel responsible for non-persistence
personnel with information security responsibilities
system/network administrators
system developers

Test

Automated mechanisms supporting and/or implementing the initiation and termination of non-persistent components

03.14.16E Tainting – Assessment Procedure

Assessment Objective

Determine if:

data or capabilities are embedded in [Assignment: systems or system components] to determine if CUI has been exfiltrated or improperly removed from the organization.

Assessment Methods

Examine

System and information integrity policy
system and information integrity procedures
procedures addressing software and information integrity
system design documentation
system configuration settings and associated documentation
policy and procedures addressing the systems security engineering technique of deception
system security plan
other relevant documents or records

Interview

Personnel responsible for detecting tainted data
personnel with systems security engineering responsibilities
personnel with information security responsibilities

Test

Automated mechanisms for post-breach detection
decoys, traps, lures, and methods for deceiving adversaries
detection and notification mechanisms

03.14.17E System-Generated Alerts – Assessment Procedure

Assessment Objective

Determine if:

[Assignment: personnel or roles] are alerted when system-generated [Assignment: indicators of compromise] occur.

Assessment Methods

Examine

System and information integrity policy
system and information integrity procedures
system security plan
system audit records
procedures addressing system monitoring tools and techniques
system monitoring tools and techniques documentation
list of personnel selected to receive alerts
system configuration settings and associated documentation
documentation of alerts generated based on compromise indicators
other relevant documents or records

Interview

Personnel with information security responsibilities
system developers
personnel installing, configuring, and/or maintaining the system
personnel responsible for monitoring the system
personnel on the system alert notification list
personnel responsible for the intrusion detection system
system/network administrators

Test

Processes for intrusion detection and system monitoring
mechanisms supporting and/or implementing intrusion detection and system monitoring capabilities
mechanisms supporting and/or implementing alerts for compromise indicators

03.14.18E Automated Organization-Generated Alerts – Assessment Procedure

Assessment Objective

Determine if:

[Assignment: personnel or roles] are alerted using [Assignment: automated mechanisms] when [Assignment: activities] indicate inappropriate or unusual activities with security implications.

Assessment Methods

Examine

System and information integrity policy
system and information integrity procedures
system security plan
list of inappropriate or unusual activities with security implications that trigger alerts
suspicious activity reports
system monitoring tools and techniques documentation
system design documentation
procedures addressing system monitoring tools and techniques
alerts provided to security personnel
system configuration settings and associated documentation
system monitoring logs or records
system audit records
other relevant documents or records

Interview

Personnel with information security responsibilities
system developers
personnel installing, configuring, and/or maintaining the system
personnel responsible for monitoring the system
personnel responsible for the intrusion detection system
system/network administrators

Test

Processes for intrusion detection and system monitoring
automated mechanisms supporting and/or implementing intrusion detection and system monitoring capabilities
automated mechanisms supporting and/or implementing automated alerts to security personnel

03.14.19E Wireless Intrusion Detection – Assessment Procedure

Assessment Objective

Determine if:

a wireless intrusion detection system is employed to identify rogue wireless devices.
a wireless intrusion detection system is employed to detect attack attempts on the system.
a wireless intrusion detection system is employed to detect a potential compromise or breach to the system.

Assessment Methods

Examine

System and information integrity policy
system and information integrity procedures
procedures addressing system monitoring tools and techniques
system design documentation
system monitoring tools and techniques documentation
system configuration settings and associated documentation
system protocols
system audit records
system security plan
other relevant documents or records

Interview

System/network administrators
organizational personnel with information security responsibilities
organizational personnel installing, configuring, and/or maintaining the system
organizational personnel responsible for monitoring the system
organizational personnel responsible for the intrusion detection system

Test

Organizational processes for intrusion detection
mechanisms supporting and/or implementing a wireless intrusion detection capability

03.15.01E Security Architecture – Assessment Procedure

Assessment Objective

Determine if:

a security architecture for the system that describes the requirements and approach to be taken for protecting the confidentiality, integrity, and availability of CUI is developed.
a security architecture for the system that describes how the security architecture is integrated into and supports the enterprise architecture is developed.
a security architecture for the system that describes any assumptions about and dependencies on external systems and services is developed.
the security architecture is reviewed and updated [Assignment: frequency] to reflect changes in the enterprise architecture.
planned security architecture changes are reflected in system security plans, concept of operations, criticality analyses, organizational procedures, procurements, and acquisitions.

Assessment Methods

Examine

Security planning policy
procedures addressing information security architecture development
procedures addressing information security architecture reviews and updates
enterprise architecture documentation
information security architecture documentation
system security plan
security CONOPS for the system
records of information security architecture reviews and updates
other relevant documents or records

Interview

Personnel with security planning and plan implementation responsibilities
personnel with information security responsibilities
personnel with information security architecture development responsibilities

Test

Mechanisms supporting and/or implementing the development, review, and update of the information security architecture
processes for developing, reviewing, and updating the information security architecture

03.15.02E Defense In Depth – Assessment Procedure

Assessment Objective

Determine if:

the security architecture for the system is designed using a defense-in-depth approach.
[Assignment: security requirements] are allocated to [Assignment: architectural layers and locations].
the security requirements allocated to the architectural layers and locations are coordinated and mutually reinforcing.

Assessment Methods

Examine

Security planning policy
procedures addressing information security architecture development
enterprise architecture documentation
information security architecture documentation
system security plan
security CONOPS for the system
other relevant documents or records

Interview

Personnel with information security responsibilities
personnel with information security architecture development responsibilities
personnel with security planning and plan implementation responsibilities

Test

Processes for designing the information security architecture
mechanisms supporting and/or implementing the design of the information security architecture

03.15.03E Supplier Diversity – Assessment Procedure

Assessment Objective

Determine if:

[Assignment: safeguards] that are allocated to [Assignment: architectural layers and locations] are obtained from different suppliers.

Assessment Methods

Examine

Security planning policy
procedures addressing information security architecture development
enterprise architecture documentation
information security architecture documentation
system security plan
security CONOPS for the system
IT acquisitions policy
other relevant documents or records

Interview

Personnel with acquisition responsibilities personnel with information security responsibilities
personnel with security planning and plan implementation responsibilities
personnel with information security architecture development responsibilities

Test

Processes for obtaining information security safeguards from different suppliers

03.16.01E Specialization – Assessment Procedure

Assessment Objective

Determine if:

[Assignment: SELECTED PARAMETER VALUE(S)] is/are employed to [Assignment: systems or system components] supporting mission-essential services or functions to increase the trustworthiness in those systems or components.

Assessment Methods

Examine

System and services acquisition policy
procedures addressing design modification, augmentation, or reconfiguration of systems or system components
documented evidence of design modification, augmentation, or reconfiguration
system security plan
supply chain risk management plan
other relevant documents or records

Interview

Personnel with system and service acquisition responsibilities
personnel with information security responsibilities
personnel with security architecture responsibilities
personnel with configuration management responsibilities

Test

Processes for the modification, design, augmentation, or reconfiguration of systems or system components
mechanisms supporting and/or implementing design modification, augmentation, or reconfiguration of systems or system components

03.17.01E Notification Agreements – Assessment Procedure

Assessment Objective

Determine if:

agreements and procedures are established with entities involved in the supply chain for the system, system components, or system service for [Assignment: SELECTED PARAMETER VALUE(S)].

Assessment Methods

Examine

Supply chain risk management policy and procedures
supply chain risk management plan
system and services acquisition policy
acquisition contracts for the system, system component, or system service
procedures addressing supply chain protection
acquisition documentation
service-level agreements
system security plan
inter-organizational agreements and procedures
other relevant documents or records

Interview

Personnel with system and service acquisition responsibilities
personnel with information security responsibilities
personnel with supply chain risk management responsibilities

Test

Processes for establishing inter-organizational agreements and procedures with supply chain entities

03.17.02E Inspection of Systems or Components – Assessment Procedure

Assessment Objective

Determine if:

[Assignment: systems or system components] are inspected [Assignment: SELECTED PARAMETER VALUE(S)] to detect tampering.

Assessment Methods

Examine

Supply chain risk management policy and procedures
supply chain risk management plan
system and services acquisition policy
records of random inspections
inspection reports or results
assessment reports or results
acquisition documentation
acquisition contracts for the system, system component, or system service
inter-organizational agreements and procedures
system security plan
service-level agreements
other relevant documents or records

Interview

Personnel with system and services acquisition responsibilities
personnel with information security responsibilities
personnel with supply chain risk management responsibilities

Test

Processes for establishing inter-organizational agreements and procedures with supply chain entities
processes to inspect for tampering

03.17.03E Component Authenticity – Assessment Procedure

Assessment Objective

Determine if:

an anti-counterfeit policy is developed and implemented.
anti-counterfeit procedures are developed and implemented.
the anti-counterfeit policy and procedures include the means to detect counterfeit components entering the system.
the anti-counterfeit policy and procedures include the means to prevent counterfeit components from entering the system.
counterfeit system components are reported to [Assignment: SELECTED PARAMETER VALUE(S)].

Assessment Methods

Examine

Supply chain risk management policy and procedures
supply chain risk management plan
system and services acquisition policy
anti-counterfeit plan
anti-counterfeit policy and procedures
media disposal policy
media protection policy
incident response policy
reports notifying developers, manufacturers, vendors, contractors, and/or external reporting organizations of counterfeit system components
acquisition documentation
service-level agreements
acquisition contracts for the system, system component, or system service
inter-organizational agreements and procedures
records of reported counterfeit system components
system security plan
other relevant documents or records

Interview

Personnel with system and service acquisition responsibilities
personnel with information security responsibilities
personnel with supply chain risk management responsibilities
personnel with responsibilities for anti-counterfeit policies, procedures, and reporting

Test

Processes for counterfeit prevention, detection, and reporting
mechanisms supporting and/or implementing anti-counterfeit detection, prevention, and reporting

03.17.04E Provenance – Assessment Procedure

Assessment Objective

Determine if:

valid provenance is documented for [Assignment: systems, system components, and associated CUI].
valid provenance is monitored for [Assignment: systems, system components, and associated CUI].
valid provenance is maintained for [Assignment: systems, system components, and associated CUI].

Assessment Methods

Examine

Supply chain risk management policy
supply chain risk management procedures
supply chain risk management plan
documentation of critical systems, critical system components, and associated data
documentation showing the history of ownership, custody, and location of and changes to critical systems or critical system components
system architecture
inter-organizational agreements and procedures
contracts
system security plan
other relevant documents or records

Interview

Organizational personnel with acquisition responsibilities
organizational personnel with information security responsibilities
organizational personnel with supply chain risk management responsibilities

Test

Organizational processes for identifying the provenance of critical systems and critical system components
mechanisms used to document, monitor, or maintain provenance

03.17.05E Supply Chain Integrity – Pedigree – Assessment Procedure

Assessment Objective

Determine if:

[Assignment: safeguards] are employed to ensure the integrity of the system and system components.
[Assignment: analysis method] is conducted to ensure the integrity of the system and system components.

Assessment Methods

Examine

Supply chain risk management policy and procedures
supply chain risk management plan
system and services acquisition policy
procedures addressing supply chain protection
bill of materials for critical systems or system components
acquisition documentation
software identification tags
manufacturer declarations of platform attributes (e.g., serial numbers, hardware component inventory) and measurements (e.g., firmware hashes) that are tightly bound to the hardware itself
system security plan
other relevant documents or records

Interview

Organizational personnel with system and services acquisition responsibilities
organizational personnel with information security responsibilities
organizational personnel with supply chain risk management responsibilities

Test

Organizational processes for identifying pedigree information
organizational processes to determine and validate the integrity of the internal composition of critical systems and critical system components
mechanisms to determine and validate the integrity of the internal composition of critical systems and critical system components

Sotto-ticket

Assessment Objective

Assessment Methods

Examine

Interview

Test

Assessment Objective

Assessment Methods

Examine

Interview

Test

Assessment Objective

Assessment Methods

Examine

Interview

Test

Assessment Objective

Assessment Methods

Examine

Interview

Test

Assessment Objective

Assessment Methods

Examine

Interview

Assessment Objective

Assessment Methods

Examine

Interview

Test

Assessment Objective

Assessment Methods

Examine

Interview

Test

Assessment Objective

Assessment Methods

Examine

Interview

Test

Assessment Objective

Assessment Methods

Examine

Interview

Test

Assessment Objective

Assessment Methods

Examine

Interview

Test

Assessment Objective

Assessment Methods

Examine

Interview

Test

Assessment Objective

Assessment Methods

Examine

Interview

Test

Assessment Objective

Assessment Methods

Examine

Interview

Test

Assessment Objective

Assessment Methods

Examine

Interview

Test

Assessment Objective

Assessment Methods

Examine

Interview

Test

Assessment Objective

Assessment Methods

Examine

Interview

Test