Assessment Objective

Determine if:

• system accounts are created in accordance with organizational policy, procedures, prerequisites, and criteria.
• system accounts are enabled in accordance with organizational policy, procedures, prerequisites, and criteria.
• system accounts are modified in accordance with organizational policy, procedures, prerequisites, and criteria.
• system accounts are disabled in accordance with organizational policy, procedures, prerequisites, and criteria.
• system accounts are removed in accordance with organizational policy, procedures, prerequisites, and criteria.
• system account types allowed are defined.
• system account types prohibited are defined.
• authorized users of the system are specified.
• group and role memberships are specified.
• access authorizations (i.e., privileges) for each account are specified.
• access to the system is authorized based on a valid access authorization.
• access to the system is authorized based on intended system usage.
• the use of system accounts is monitored.
• system accounts are disabled when the accounts have expired.
• system accounts are disabled when the accounts have been inactive for [Assignment: time period].
• system accounts are disabled when the accounts are no longer associated with a user or individual.
• system accounts are disabled when the accounts violate organizational policy.
• account managers and designated personnel or roles are notified within [Assignment: time period] when accounts are no longer required.
• account managers and designated personnel or roles are notified within [Assignment: time period] when users are terminated or transferred.
• account managers and designated personnel or roles are notified within [Assignment: time period] when system usage or the need-to-know changes for an individual.
• system accounts are disabled when significant risks associated with individuals are discovered.
• users are required to log out of the system after [Assignment: time period] of expected inactivity or when the following circumstances occur: [Assignment: circumstances].

Assessment Methods

Examine

• access control policy and procedures
• personnel termination or transfer policies and procedures
• procedures for account management
• list of active system accounts and the name of the individual associated with each account
• system design documentation
• list of conditions for group and role membership
• system configuration settings
• notifications of recent transfers, separations, or terminations of employees
• list of recently disabled system accounts and the name of the individual associated with each account
• list of user activities that pose significant organizational risks
• access authorization records
• account management compliance reviews
• system monitoring and audit records
• system security plan
• system-generated list of accounts removed
• system-generated list of emergency accounts disabled
• system-generated list of disabled accounts
• other relevant documents and records

Interview

• personnel with account management responsibilities
• system administrators
• personnel with information security responsibilities
• system developers

Test

• processes for account management on the system
• mechanisms for implementing account management

Assessment Objective

Determine if:

• approved authorizations for logical access to CUI are enforced in accordance with applicable access control policies.
• approved authorizations for logical access to system resources are enforced in accordance with applicable access control policies.

Assessment Methods

Examine

• access control policy and procedures
• procedures for access enforcement
• system design documentation
• system configuration settings
• list of approved authorizations (i.e., user privileges)
• system audit records
• system security plan
• other relevant documents or records

Interview

• personnel with access enforcement responsibilities
• system administrators
• personnel with information security responsibilities
• system developers

Test

• mechanisms for implementing the access control policy

Assessment Objective

Determine if:

• approved authorizations are enforced for controlling the flow of CUI within the system.
• approved authorizations are enforced for controlling the flow of CUI between connected systems.

Assessment Methods

Examine

• access control policy and procedures
• information flow control policies
• procedures for information flow enforcement
• security architecture and design documentation
• system configuration settings
• system baseline configuration
• system audit records
• list of information flow authorizations
• system security plan
• other relevant documents or records

Interview

• system administrators
• personnel with security architecture responsibilities
• personnel with information security responsibilities
• system developers

Test

• mechanisms for implementing the information flow enforcement policy

Assessment Objective

Determine if:

• duties of individuals requiring separation are identified.
• system access authorizations to support separation of duties are defined.

Assessment Methods

Examine

• access control policy and procedures
• procedures for the separation of duties and the division of responsibilities
• system configuration settings
• system audit records
• system access authorizations
• list of divisions of responsibility and separation of duties
• system security plan
• other relevant documents or records

Interview

• personnel with responsibilities for defining the separation of duties and the division of responsibilities
• personnel with information security responsibilities
• system administrators

Test

• mechanisms for implementing the separation of duties policy

Assessment Objective

Determine if:

• system access for users (or processes acting on behalf of users) is authorized only when necessary to accomplish assigned organizational tasks.
• access to [Assignment: security functions] is authorized.
• access to [Assignment: security-relevant information] is authorized.
• the privileges assigned to roles or classes of users are reviewed [Assignment: frequency] to validate the need for such privileges.
• privileges are reassigned or removed, as necessary.

Assessment Methods

Examine

• access control policy and procedures
• procedures for least privilege
• list of assigned access authorizations (i.e., privileges)
• system configuration settings
• system audit records
• list of security functions (implemented in hardware, software, and firmware)
• security-relevant information for which access must be explicitly authorized
• list of system-generated roles or classes of users and assigned privileges
• validation reviews of privileges assigned to roles or classes of users
• records of privilege removals or reassignments for roles or classes of users
• system security plan
• system design documentation
• other relevant documents or records

Interview

• personnel with responsibilities for defining least privileges
• personnel with information security responsibilities
• system administrators

Test

• mechanisms for implementing least privilege functions
• mechanisms for implementing reviews of user privileges

Assessment Objective

Determine if:

• privileged accounts on the system are restricted to [Assignment: personnel or roles].
• users (or roles) with privileged accounts are required to use non-privileged accounts when accessing non-security functions or non-security information.

Assessment Methods

Examine

• access control policy and procedures
• procedures for least privilege
• list of system-generated privileged accounts
• list of system administration personnel
• system audit records
• system configuration settings
• system security plan
• list of system-generated security functions or security-relevant information assigned to system accounts or roles
• other relevant documents or records

Interview

• personnel with responsibilities for defining least privileges
• personnel with information security responsibilities
• system administrators

Test

• mechanisms for implementing least privilege functions

Assessment Objective

Determine if:

• the execution of privileged functions is logged.
• non-privileged users are prevented from executing privileged functions.

Assessment Methods

Examine

• access control policy and procedures
• procedures for least privilege
• system design documentation
• system configuration settings
• system audit records
• list of audited events
• list of privileged functions to be audited and associated user account assignments
• system security plan
• other relevant documents or records

Interview

• personnel with responsibilities for reviewing least privileges
• personnel with information security responsibilities
• system developers
• system administrators

Test

• mechanisms for auditing the execution of least privilege functions
• mechanisms for implementing least privilege functions for non-privileged users

Assessment Objective

Determine if:

• a limit of [Assignment: number] consecutive invalid logon attempts by a user during [Assignment: time period] is enforced.
• [Assignment: SELECTED PARAMETER VALUES] when the maximum number of unsuccessful attempts is exceeded.

Assessment Methods

Examine

• access control policy and procedures
• procedures for unsuccessful logon attempts
• system design documentation
• system audit records
• system configuration settings
• system security plan
• other relevant documents or records

Interview

• personnel with information security responsibilities
• system developers
• system administrators

Test

• mechanisms for implementing the access control policy for unsuccessful logon attempts

Assessment Objective

Determine if:

• a system use notification message with privacy and security notices consistent with applicable CUI rules is displayed before granting access to the system.

Assessment Methods

Examine

• access control policy and procedures
• privacy and security policies, procedures for system use notification
• documented approval of system use notification messages
• system audit records
• user acknowledgements of system use notification messages
• system design documentation
• system configuration settings
• system use notification messages
• system security plan
• other relevant documents or records

Interview

• personnel with information security responsibilities
• legal counsel
• system developers
• system administrators

Test

• mechanisms for implementing system use notifications

Assessment Objective

Determine if:

• access to the system is prevented by [Assignment: SELECTED PARAMETER VALUES].
• information previously visible on the display is concealed via device lock with a publicly viewable image.
• the device lock is retained until the user reestablishes access using established identification and authentication procedures.

Assessment Methods

Examine

• access control policy and procedures
• procedures for session lock and identification and authentication
• system design documentation
• system configuration settings
• display screen with session lock activated
• system security plan
• other relevant documents or records

Interview

• personnel with information security responsibilities
• system developers
• system administrators

Test

• mechanisms for implementing the access control policy for session lock
• session lock mechanisms

Assessment Objective

Determine if:

• a user session is terminated automatically after [Assignment: conditions or trigger events].

Assessment Methods

Examine

• access control policy and procedures
• procedures for session termination
• system design documentation
• system configuration settings
• list of conditions or trigger events requiring session disconnect
• system audit records
• system security plan
• other relevant documents or records

Interview

• personnel with information security responsibilities
• system developers
• system administrators

Test

• automated mechanisms for implementing user session termination

Assessment Objective

Determine if:

• types of allowable remote system access are defined.
• usage restrictions are established for each type of allowable remote system access.
• configuration requirements are established for each type of allowable remote system access.
• connection requirements are established for each type of allowable remote system access.
• each type of remote system access is authorized prior to establishing such connections.
• remote access to the system is routed through authorized access control points.
• remote access to the system is routed through managed access control points.
• remote execution of privileged commands is authorized.
• remote access to security-relevant information is authorized.

Assessment Methods

Examine

• access control policy and procedures
• procedures for remote system access
• remote system access configuration and connection requirements
• configuration management plan
• system configuration settings
• remote access authorizations
• system audit records
• system design documentation
• procedures for remote access to the system
• system monitoring records
• list of managed network access control points
• system security plan
• other relevant documents or records

Interview

• personnel with responsibilities for managing remote access connections
• personnel with information security responsibilities
• system administrators

Test

• mechanisms for monitoring and controlling remote access methods
• mechanisms for routing remote accesses through managed access control points
• remote access management capability for the system

Assessment Objective

Determine if:

• each type of wireless access to the system is defined.
• usage restrictions are established for each type of wireless access to the system.
• configuration requirements are established for each type of wireless access to the system.
• connection requirements are established for each type of wireless access to the system.
• each type of wireless access to the system is authorized prior to establishing such connections.
• wireless networking capabilities not intended for use are disabled prior to issuance and deployment.
• wireless access to the system is protected using authentication.
• wireless access to the system is protected using encryption.

Assessment Methods

Examine

• access control policy and procedures
• procedures for wireless system access
• wireless system access configuration and connection requirements
• configuration management plan
• system configuration settings
• wireless access authorizations
• system audit records
• system design documentation
• system security plan
• other relevant documents or records

Interview

• personnel with responsibilities for managing wireless access connections
• personnel with information security responsibilities
• system developers
• system administrators

Test

• wireless access management capability for the system
• mechanisms for implementing wireless access protections to the system
• mechanisms for managing the disabling of wireless networking capabilities

Assessment Objective

Determine if:

• usage restrictions are established for mobile devices.
• configuration requirements are established for mobile devices.
• connection requirements are established for mobile devices.
• the connection of mobile devices to the system is authorized.
• full-device or container-based encryption is implemented to protect the confidentiality of CUI on mobile devices.

Assessment Methods

Examine

• access control policy and procedures
• procedures for mobile device access control
• system design documentation
• configuration management plan
• system configuration settings
• authorizations for mobile device connections to organizational systems
• system audit records
• encryption mechanisms and associated configuration documentation
• system security plan
• other relevant documents or records

Interview

• personnel with access control responsibilities for mobile devices
• personnel using mobile devices to access organizational systems
• personnel with information security responsibilities
• system administrators

Test

• access control capability for mobile device connections to organizational systems
• encryption mechanisms for protecting the confidentiality of CUI on mobile devices
• configurations of mobile devices

Assessment Objective

Determine if:

• the following security requirements to be satisfied on external systems prior to allowing the use of or access to those systems by authorized individuals are established: [Assignment: security requirements].
• the use of external systems is prohibited unless the systems are specifically authorized.
• authorized individuals are permitted to use external systems to access the organizational system or to process, store, or transmit CUI only after verifying that the security requirements on the external systems as specified in the organization’s system security plans have been satisfied.
• the use of organization-controlled portable storage devices by authorized individuals on external systems is restricted.
• authorized individuals are permitted to use external systems to access the organizational system or to process, store, or transmit CUI only after retaining approved system connection or processing agreements with the organizational entity hosting the external systems.

Assessment Methods

Examine

• access control policy and procedures
• procedures for the use of external systems
• terms and conditions for the use of external systems
• external systems security requirements
• list of types of applications accessible from external systems
• system configuration settings
• system security plan
• other relevant documents or records

Interview

• personnel with responsibilities for defining terms, conditions, and security requirements for the use of external systems
• personnel with information security responsibilities
• system administrators

Test

• mechanisms for implementing or enforcing terms, conditions, and security requirements for the use of external systems

Assessment Objective

Determine if:

• authorized individuals are trained to ensure that publicly accessible information does not contain CUI.
• the content on publicly accessible systems is reviewed for CUI.
• CUI is removed from publicly accessible systems, if discovered.

Assessment Objective

Determine if:

• security literacy training is provided to system users as part of initial training for new users.
• security literacy training is provided to system users [Assignment: frequency] after initial training.
• security literacy training is provided to system users when required by system changes or following [Assignment: events].
• security literacy training is provided to system users on recognizing indicators of insider threat.
• security literacy training is provided to system users on reporting indicators of insider threat.
• security literacy training is provided to system users on recognizing indicators of social engineering.
• security literacy training is provided to system users on reporting indicators of social engineering.
• security literacy training is provided to system users on recognizing indicators of social mining.
• security literacy training is provided to system users on reporting indicators of social mining.
• security literacy training content is updated [Assignment: frequency].
• security literacy training content is updated following [Assignment: events].

Assessment Methods

Examine

• security literacy training and awareness policy and procedures
• procedures for security literacy training and awareness implementation
• codes of federal regulations
• security literacy and awareness training curriculum
• security literacy and awareness training materials
• training records
• system security plan
• other relevant documents or records

Interview

• personnel with responsibilities for security literacy training and awareness
• personnel comprising the general system user community
• personnel with information security responsibilities

Test

• mechanisms for managing information security literacy training and awareness

Assessment Objective

Determine if:

• role-based security training is provided to organizational personnel before authorizing access to the system or CUI.
• role-based security training is provided to organizational personnel before performing assigned duties.
• role-based security training is provided to organizational personnel [Assignment: frequency] after initial training.
• role-based security training is provided to organizational personnel when required by system changes or following [Assignment: events].
• role-based security training content is updated [Assignment: frequency].
• role-based security training content is updated following [Assignment: events].

Assessment Methods

Examine

• security awareness and training policy and procedures
• procedures for security training implementation
• codes of federal regulations
• security training curriculum
• security training materials
• training records
• system security plan
• other relevant documents or records

Interview

• personnel with responsibilities for role-based security training
• personnel with assigned system security roles and responsibilities

Test

• mechanisms for managing role-based security training and awareness

Assessment Objective

Determine if:

• the following event types are specified for logging within the system: [Assignment: event types].
• the event types selected for logging are reviewed [Assignment: frequency].
• the event types selected for logging are updated [Assignment: frequency].

Assessment Methods

Examine

• audit and accountability policy and procedures
• procedures for auditable events
• system design documentation
• system configuration settings
• system audit records
• system auditable events
• system security plan
• other relevant documents or records

Interview

• personnel with audit and accountability responsibilities
• personnel with information security responsibilities
• system administrators

Test

• mechanisms for implementing system auditing

Assessment Objective

Determine if:

• audit records contain information that establishes what type of event occurred.
• audit records contain information that establishes when the event occurred.
• audit records contain information that establishes where the event occurred.
• audit records contain information that establishes the source of the event.
• audit records contain information that establishes the outcome of the event.
• audit records contain information that establishes the identity of the individuals, subjects, objects, or entities associated with the event.
• additional information for audit records is provided, as needed.

Assessment Methods

Examine

• audit and accountability policy and procedures
• procedures for the content of audit records
• list of organization-defined auditable events
• system design documentation
• system configuration settings
• system audit records
• system incident reports
• system security plan
• other relevant documents or records

Interview

• personnel with audit and accountability responsibilities
• personnel with information security responsibilities
• system developers
• system administrators

Test

• mechanisms for implementing system auditing of auditable events
• system audit capability

Assessment Objective

Determine if:

• audit records for the selected event types and audit record content specified in 03.03.01 and 03.03.02 are generated.
• audit records are retained for a time period consistent with the records retention policy.

Assessment Methods

Examine

• audit and accountability policy and procedures
• procedures for audit record generation
• system design documentation
• list of auditable events
• system audit records
• audit record retention policy and procedures
• organization-defined retention period for audit records
• audit record archives
• system configuration settings
• system security plan
• other relevant documents or records

Interview

• personnel with audit record generation responsibilities
• personnel with audit record retention responsibilities
• personnel with information security responsibilities
• system developers
• system administrators

Test

• mechanisms for implementing the audit record generation capability

Assessment Objective

Determine if:

• organizational personnel or roles are alerted in the event of an audit logging process failure within [Assignment: time period].
• the following additional actions are taken: [Assignment: additional actions].

Assessment Methods

Examine

• audit and accountability policy and procedures
• procedures for responding to audit processing failures
• system design documentation
• system configuration settings
• list of personnel to be notified in case of an audit processing failure
• system audit records
• system security plan
• other relevant documents or records

Interview

• personnel with audit and accountability responsibilities
• personnel with information security responsibilities
• system developers
• system administrators

Test

• mechanisms for implementing system response to audit processing failures

Assessment Objective

Determine if:

• system audit records are reviewed and analyzed [Assignment: frequency] for indications and the potential impact of inappropriate or unusual activity.
• findings are reported to organizational personnel or roles.
• audit records across different repositories are analyzed to gain organization-wide situational awareness.
• audit records across different repositories are correlated to gain organization-wide situational awareness.

Assessment Methods

Examine

• audit and accountability policy and procedures
• procedures for audit record review, analysis, and reporting
• reports of audit record findings
• records of actions taken in response to reviews and analyses of audit records
• system design documentation
• system audit records across different repositories
• system security plan
• system configuration settings
• other relevant documents or records

Interview

• personnel with audit record review, analysis, and reporting responsibilities
• personnel with information security responsibilities

Test

• mechanisms for supporting the analysis and correlation of audit records

Assessment Objective

Determine if:

• an audit record reduction and report generation capability that supports audit record review is implemented.
• an audit record reduction and report generation capability that supports audit record analysis is implemented.
• an audit record reduction and report generation capability that supports audit record reporting requirements is implemented.
• an audit record reduction and report generation capability that supports after-the-fact investigations of incidents is implemented.
• the original content of audit records is preserved.
• the original time ordering of audit records is preserved.

Assessment Methods

Examine

• audit and accountability policy and procedures
• procedures for audit record reduction and report generation
• audit record reduction, review, analysis, and reporting tools
• system audit records
• system design documentation
• system configuration settings
• system security plan
• other relevant documents or records

Interview

• personnel with audit record reduction and report generation responsibilities
• personnel with information security responsibilities

Test

• mechanisms for supporting audit record reduction and report generation capability

Assessment Objective

Determine if:

• internal system clocks are used to generate time stamps for audit records.
• time stamps are recorded for audit records that use Coordinated Universal Time (UTC), have a fixed local time offset from UTC, or include the local time offset as part of the time stamp.
• time stamps are recorded for audit records that meet [Assignment: granularity of time measurement].

Assessment Methods

Examine

• audit and accountability policy and procedures
• procedures for timestamp generation
• system design documentation
• system configuration settings
• system audit records
• system security plan
• other relevant documents or records

Interview

• personnel with information security responsibilities
• system developers
• system administrators

Test

• mechanisms for implementing timestamp generation

Assessment Objective

Determine if:

• access to management of audit logging functionality is authorized to only a subset of privileged users or roles.
• audit information is protected from unauthorized access, modification, and deletion.
• audit logging tools are protected from unauthorized access, modification, and deletion.

Assessment Methods

Examine

• audit and accountability policy and procedures
• access control policy and procedures
• procedures for the protection of audit information
• system configuration settings
• system audit records
• audit tools
• system-generated list of privileged users with access to the management of audit functionality
• access authorizations
• access control list
• system design documentation
• system security plan
• other relevant documents or records

Interview

• personnel with audit and accountability responsibilities
• personnel with information security responsibilities
• system developers
• system administrators

Test

• mechanisms for implementing audit information protection
• mechanisms for managing access to audit functionality

Assessment Objective

Determine if:

• a current baseline configuration of the system is developed.
• a current baseline configuration of the system is maintained under configuration control.
• the baseline configuration of the system is updated [Assignment: frequency].
• the baseline configuration of the system is reviewed when system components are installed or modified.
• the baseline configuration of the system is updated when system components are installed or modified.
• the baseline configuration of the system is reviewed [Assignment: frequency].

Assessment Methods

Examine

• configuration management policy and procedures
• procedures for the baseline system configuration
• configuration management plan
• enterprise architecture
• system design documentation
• system architecture
• system configuration settings
• system component inventory
• change control records
• system security plan
• other relevant documents or records

Interview

• personnel with configuration management responsibilities
• personnel with information security responsibilities
• system administrators

Test

• processes for managing baseline configurations
• mechanisms for supporting configuration control of the baseline configuration

Assessment Objective

Determine if:

• the following configuration settings for the system that reflect the most restrictive mode consistent with operational requirements are established and documented: [Assignment: configuration settings].
• any deviations from established configuration settings are identified and documented.
• any deviations from established configuration settings are approved.
• the following configuration settings for the system are implemented: [Assignment: configuration settings].

Assessment Methods

Examine

• configuration management policy and procedures
• procedures for system configuration settings
• configuration management plan
• system design documentation
• system configuration settings
• common secure configuration checklists
• system component inventory
• evidence supporting approved deviations from established configuration settings
• change control records
• system data processing and retention permissions
• system audit records
• system security plan
• other relevant documents or records

Interview

• personnel with security configuration management responsibilities
• personnel with information security responsibilities
• system administrators

Test

• processes for managing configuration settings
• mechanisms that implement, monitor, or control system configuration settings
• mechanisms that identify or document deviations from established configuration settings

Assessment Objective

Determine if:

• the types of changes to the system that are configuration-controlled are defined.
• proposed configuration-controlled changes to the system are reviewed with explicit consideration for security impacts.
• proposed configuration-controlled changes to the system are approved or disapproved with explicit consideration for security impacts.
• activities associated with configuration-controlled changes to the system are monitored.
• activities associated with configuration-controlled changes to the system are reviewed.
• approved configuration-controlled changes to the system are implemented.
• approved configuration-controlled changes to the system are documented.

Assessment Methods

Examine

• configuration management policy and procedures
• procedures for system configuration change control
• configuration management plan
• system architecture
• configuration settings
• change control records
• system audit records
• change control audit and review reports
• agenda, minutes, and documentation from configuration change control oversight meetings
• system security plan
• other relevant documents or records

Interview

• personnel with configuration change control responsibilities
• personnel with information security responsibilities
• members of change control board or similar
• system administrators

Test

• processes for configuration change control
• mechanisms that implement configuration change control

Assessment Objective

Determine if:

• the security requirements for the system continue to be satisfied after the system changes have been implemented.
• changes to the system are analyzed to determine potential security impacts prior to change implementation.

Assessment Methods

Examine

• configuration management policy and procedures
• procedures for security impact analyses for system changes
• configuration management plan
• security impact analysis documentation
• system design documentation
• analysis tools and outputs
• change control records
• system audit records
• system security plan
• other relevant documents or records

Interview

• personnel with security impact analysis responsibilities
• personnel with information security responsibilities
• members of change control board
• system developers
• system administrators

Test

• processes for security impact analyses

Assessment Objective

Determine if:

• physical access restrictions associated with changes to the system are defined and documented.
• physical access restrictions associated with changes to the system are approved.
• physical access restrictions associated with changes to the system are enforced.
• logical access restrictions associated with changes to the system are defined and documented.
• logical access restrictions associated with changes to the system are approved.
• logical access restrictions associated with changes to the system are enforced.

Assessment Methods

Examine

• configuration management policy and procedures
• procedures for access restrictions for system changes
• configuration management plan
• system design documentation
• system architecture
• system configuration settings
• logical access approvals
• physical access approvals
• access credentials
• change control records
• system audit records
• system security plan
• other relevant documents or records

Interview

• personnel with logical access control responsibilities
• personnel with physical access control responsibilities
• personnel with information security responsibilities
• system administrators

Test

• processes for managing access restrictions for system changes
• mechanisms for supporting, implementing, or enforcing access restrictions associated with system changes

Assessment Objective

Determine if:

• the use of the following functions is prohibited or restricted: [Assignment: functions].
• the use of the following ports is prohibited or restricted: [Assignment: ports].
• the use of the following protocols is prohibited or restricted: [Assignment: protocols].
• the use of the following connections is prohibited or restricted: [Assignment: connections].
• the use of the following services is prohibited or restricted: [Assignment: services].
• the system is reviewed [Assignment: frequency] to identify unnecessary or nonsecure functions, ports, protocols, connections, and services.
• unnecessary or nonsecure functions, ports, protocols, connections, and services are disabled or removed.
• the system is configured to provide only mission-essential capabilities.

Assessment Methods

Examine

• configuration management policy and procedures
• procedures for least functionality in the system
• configuration management plan
• system design documentation
• system configuration settings
• system component inventory
• common secure configuration checklists
• documented reviews of functions, ports, protocols, and services
• change control records
• system audit records
• system security plan
• other relevant documents or records

Interview

• personnel with configuration management responsibilities
• personnel with responsibilities for reviewing functions, ports, protocols, and services
• personnel with information security responsibilities
• system developers
• system administrators

Test

• processes for prohibiting or restricting functions, ports, protocols, and services
• processes for reviewing or disabling functions, ports, protocols, and services
• mechanisms for implementing the review and disabling of functions, ports, protocols, and services
• mechanisms for implementing restrictions on or the prohibition of functions, ports, protocols, and services

Assessment Objective

Determine if:

• software programs authorized to execute on the system are identified.
• a deny-all, allow-by-exception policy for the execution of authorized software programs on the system is implemented.
• the list of authorized software programs is reviewed and updated [Assignment: frequency].

Assessment Methods

Examine

• configuration management policy and procedures
• procedures for least functionality in the system
• configuration management plan
• system design documentation
• system configuration settings
• list of software programs authorized to execute on the system
• system component inventory
• records associated with the review and update of the list of authorized software programs
• common secure configuration checklists
• change control records
• system audit records
• system security plan
• other relevant documents or records

Interview

• personnel with responsibilities for identifying software authorized to execute on the system
• personnel with information security responsibilities
• system administrators

Test

• processes for identifying, reviewing, and updating programs authorized to execute on the system
• processes for implementing authorized software policy
• mechanisms for supporting or implementing authorized software policy

Assessment Objective

Determine if:

• an inventory of system components is developed and documented.
• the system component inventory is reviewed [Assignment: frequency].
• the system component inventory is updated [Assignment: frequency].
• the system component inventory is updated as part of component installations.
• the system component inventory is updated as part of component removals.
• the system component inventory is updated as part of system updates.

Assessment Methods

Examine

• configuration management policy and procedures
• procedures for system component inventory
• configuration management plan
• system design documentation
• system component inventory
• inventory reviews and update records
• component installation records
• change control records
• component removal records
• system change records
• system security plan
• other relevant documents or records

Interview

• personnel with component inventory management responsibilities
• personnel with information security responsibilities
• system administrators

Test

• processes for managing the system component inventory
• mechanisms for supporting or implementing the system component inventory
• processes for updating the system component inventory
• mechanisms for supporting or implementing the system component inventory updates

Assessment Objective

Determine if:

• the location of CUI is identified and documented.
• the system components on which CUI is processed are identified and documented.
• the system components on which CUI is stored are identified and documented.
• changes to the system or system component location where CUI is processed are documented.
• changes to the system or system component location where CUI is stored are documented.

Assessment Methods

Examine

• configuration management policy and procedures
• configuration management plan
• procedures for identification and documentation of information location
• system audit records
• architecture documentation
• system design documentation
• list of users with system and system component access
• change control records
• system component inventory
• system security plan
• other relevant documents or records

Interview

• personnel with responsibilities for managing information location and user access
• personnel with responsibilities for operating, using, or maintaining the system
• personnel with information security responsibilities
• system developers
• system administrators

Test

• processes governing information location
• mechanisms for enforcing policies and methods for governing information location

Assessment Objective

Determine if:

• systems or system components with the following configurations are issued to individuals traveling to high-risk locations: [Assignment: configurations].
• the following security requirements are applied to the system or system components when the individuals return from travel: [Assignment: security requirements].

Assessment Methods

Examine

• configuration management policy and procedures
• configuration management plan
• procedures for the baseline configuration of the system
• procedures for system component installations and upgrades
• system component inventory
• system component installations or upgrades and associated records
• records of system baseline configuration reviews and updates
• system configuration settings
• system architecture
• change control records
• system security plan
• other relevant documents or records

Interview

• personnel with configuration management responsibilities
• personnel with information security responsibilities
• system administrators

Test

• processes for managing baseline configurations

Assessment Objective

Determine if:

• system users are uniquely identified.
• system users are authenticated.
• processes acting on behalf of users are associated with uniquely identified and authenticated system users.
• users are reauthenticated when [Assignment: circumstances or situations] .

Assessment Methods

Examine

• identification and authentication policy and procedures
• list of circumstances or situations requiring re-authentication
• system design documentation
• system configuration settings
• system audit records
• list of system accounts
• system security plan
• other relevant documents or records

Interview

• personnel with identification and authentication responsibilities
• personnel with system operations responsibilities
• personnel with account management responsibilities
• system developers
• personnel with information security responsibilities
• system administrators

Test

• processes for uniquely identifying and authenticating users
• mechanisms for supporting or implementing identification and authentication capabilities

Assessment Objective

Determine if:

• [Assignment: devices or types of devices] are authenticated before establishing a system connection.
• [Assignment: devices or types of devices] are uniquely identified before establishing a system connection.

Assessment Methods

Examine

• identification and authentication policy and procedures
• procedures for device identification and authentication
• system design documentation
• list of devices requiring unique identification and authentication
• device connection reports
• system configuration settings
• system security plan
• other relevant documents or records

Interview

• personnel with responsibilities for device identification and authentication
• personnel with information security responsibilities
• system developers
• system administrators

Test

• mechanisms for supporting or implementing device identification and authentication capabilities

Assessment Objective

Determine if:

• multi-factor authentication for access to privileged accounts is implemented.
• multi-factor authentication for access to non-privileged accounts is implemented.

Assessment Methods

Examine

• identification and authentication policy and procedures
• system design documentation
• list of system accounts
• system configuration settings
• system audit records
• system security plan
• other relevant documents or records

Interview

• personnel with system operations responsibilities
• personnel with account management responsibilities
• personnel with information security responsibilities
• system developers
• system administrators

Test

• mechanisms for supporting or implementing a multi-factor authentication capability

Assessment Objective

Determine if:

• replay-resistant authentication mechanisms for access to privileged accounts are implemented.
• replay-resistant authentication mechanisms for access to non-privileged accounts are implemented.

Assessment Methods

Examine

• identification and authentication policy and procedures
• system design documentation
• system audit records
• system configuration settings
• list of privileged system accounts
• system security plan
• other relevant documents or records

Interview

• personnel with system operations responsibilities
• personnel with account management responsibilities
• personnel with information security responsibilities
• system developers
• system administrators

Test

• mechanisms for supporting or implementing identification and authentication capabilities
• mechanisms for supporting or implementing replay-resistance

Assessment Objective

Determine if:

• authorization is received from organizational personnel or roles to assign an individual, group, role, service, or device identifier.
• an identifier that identifies an individual, group, role, service, or device is selected.
• an identifier that identifies an individual, group, role, service, or device is assigned.
• the reuse of identifiers for [Assignment: time period] is prevented.
• individual identifiers are managed by uniquely identifying each individual as [Assignment: characteristic].

Assessment Methods

Examine

• identification and authentication policy and procedures
• procedures for identifier management
• procedures for account management
• system design documentation
• list of system accounts
• list of characteristics identifying individual status
• system configuration settings
• list of identifiers generated from physical access control devices
• system security plan
• other relevant documents or records

Interview

• personnel with identifier management responsibilities
• personnel with information security responsibilities
• system developers
• system administrators

Test

• mechanisms for supporting or implementing identifier management

Assessment Objective

Determine if:

• a list of commonly used, expected, or compromised passwords is maintained.
• a list of commonly used, expected, or compromised passwords is updated [Assignment: frequency].
• a list of commonly used, expected, or compromised passwords is updated when organizational passwords are suspected to have been compromised.
• passwords are verified not to be found on the list of commonly used, expected, or compromised passwords when they are created or updated by users.
• passwords are only transmitted over cryptographically protected channels.
• passwords are stored in a cryptographically protected form.
• a new password is selected upon first use after account recovery.
• the following composition and complexity rules for passwords are enforced: [Assignment: rules].

Assessment Methods

Examine

• identification and authentication policy and procedures
• password policy
• procedures for authenticator management
• system design documentation
• system configuration settings
• password configurations
• system security plan
• other relevant documents or records

Interview

• personnel with authenticator management responsibilities
• personnel with information security responsibilities
• system developers
• system administrators

Test

• mechanisms for supporting or implementing a password-based authenticator management capability

Assessment Objective

Determine if:

• feedback of authentication information during the authentication process is obscured.

Assessment Methods

Examine

• identification and authentication policy and procedures
• procedures for authenticator feedback
• system design documentation
• system configuration settings
• system audit records
• system security plan
• other relevant documents or records

Interview

• personnel with information security responsibilities
• system developers
• system administrators

Test

• mechanisms for supporting or implementing the obscuring of feedback of authentication information during authentication

Assessment Objective

Determine if:

• the identity of the individual, group, role, service, or device receiving the authenticator as part of the initial authenticator distribution is verified.
• initial authenticator content for any authenticators issued by the organization is established.
• administrative procedures for initial authenticator distribution are established.
• administrative procedures for lost, compromised, or damaged authenticators are established.
• administrative procedures for revoking authenticators are established.
• administrative procedures for initial authenticator distribution are implemented.
• administrative procedures for lost, compromised, or damaged authenticators are implemented.
• administrative procedures for revoking authenticators are implemented.
• default authenticators are changed at first use.
• authenticators are changed or refreshed [Assignment: frequency] or when the following events occur: [Assignment: events].
• authenticator content is protected from unauthorized disclosure.
• authenticator content is protected from unauthorized modification.

Assessment Methods

Examine

• identification and authentication policy and procedures
• procedures for authenticator management
• system configuration settings
• list of system authenticator types
• system design documentation
• system audit records
• change control records associated with managing system authenticators
• system security plan
• other relevant documents or records

Interview

• personnel with authenticator management responsibilities
• personnel with information security responsibilities
• system administrators

Test

• mechanisms for supporting or implementing the authenticator management capability

Assessment Objective

Determine if:

• an incident-handling capability that is consistent with the incident response plan is implemented.
• the incident handling capability includes preparation.
• the incident handling capability includes detection and analysis.
• the incident handling capability includes containment.
• the incident handling capability includes eradication.
• the incident handling capability includes recovery.

Assessment Methods

Examine

• incident response policy and procedures
• contingency planning policy and procedures
• procedures for incident handling
• procedures for incident response planning
• incident response plan
• contingency plan
• records of incident response plan reviews and approvals
• system security plan
• other relevant documents or records

Interview

• personnel with incident handling responsibilities
• personnel with incident response planning responsibilities
• personnel with contingency planning responsibilities
• personnel with information security responsibilities

Test

• incident handling capability for the organization
• incident response plan

Assessment Objective

Determine if:

• system security incidents are tracked.
• system security incidents are documented.
• suspected incidents are reported to the organizational incident response capability within [Assignment: time period].
• incident information is reported to [Assignment: authorities].
• an incident response support resource that offers advice and assistance to system users on handling and reporting incidents is provided.

Assessment Methods

Examine

• incident response policy and procedures
• procedures for incident monitoring
• procedures for incident response assistance
• incident response records and documentation
• incident response plan
• system security plan
• other relevant documents or records

Interview

• personnel with incident monitoring responsibilities
• personnel with incident response assistance and support responsibilities
• personnel with information security responsibilities

Test

• processes for incident reporting
• incident monitoring capability
• mechanisms for supporting or implementing the tracking and documenting of system security incidents
• mechanisms for supporting or implementing incident reporting
• mechanisms for supporting or implementing incident response assistance
• processes for incident response assistance

Assessment Objective

Determine if:

• the effectiveness of the incident response capability is tested [Assignment: frequency].

Assessment Methods

Examine

• incident response policy and procedures
• contingency planning policy and procedures
• procedures for incident response testing
• procedures for contingency plan testing
• incident response testing material
• incident response test results
• incident response test plan
• incident response plan
• contingency plan
• system security plan
• other relevant documents or records

Interview

• personnel with incident response testing responsibilities
• personnel with information security responsibilities

Assessment Objective

Determine if:

• incident response training for system users consistent with assigned roles and responsibilities is provided within [Assignment: time period] of assuming an incident response role or responsibility or acquiring system access.
• incident response training for system users consistent with assigned roles and responsibilities is provided when required by system changes.
• incident response training for system users consistent with assigned roles and responsibilities is provided [Assignment: frequency] thereafter.
• incident response training content is updated following [Assignment: events].
• incident response training content is updated [Assignment: frequency].
• incident response training content is reviewed following [Assignment: events].
• incident response training content is reviewed [Assignment: frequency].

Assessment Methods

Examine

• incident response policy and procedures
• procedures for incident response training
• incident response training curriculum
• incident response training materials
• incident response plan
• incident response training records
• system security plan
• other relevant documents or records

Interview

• personnel with incident response training and operational responsibilities
• personnel with information security responsibilities

Assessment Objective

Determine if:

• an incident response plan is developed that provides the organization with a roadmap for implementing its incident response capability.
• an incident response plan is developed that describes the structure and organization of the incident response capability.
• an incident response plan is developed that provides a high-level approach for how the incident response capability fits into the overall organization.
• an incident response plan is developed that defines reportable incidents.
• an incident response plan is developed that addresses the sharing of incident information.
• an incident response plan is developed that designates responsibilities to organizational entities, personnel, or roles.
• copies of the incident response plan are distributed to designated incident response personnel (identified by name or by role).
• copies of the incident response plan are distributed to organizational elements.
• the incident response plan is protected from unauthorized disclosure.
• the incident response plan is updated to address system and organizational changes or problems encountered during plan implementation, execution, or testing.

Assessment Methods

Examine

• incident response policy
• procedures addressing incident response planning
• incident response plan
• system security plan
• records of incident response plan reviews and approvals
• other relevant documents or records

Interview

• personnel with incident response planning responsibilities
• personnel with information security responsibilities

Test

• incident response plan and related processes

Assessment Objective

Determine if:

• the use of system maintenance tools is approved.
• the use of system maintenance tools is controlled.
• the use of system maintenance tools is monitored.
• media with diagnostic and test programs are checked for malicious code before the media are used in the system.
• the removal of system maintenance equipment containing CUI is prevented by verifying that there is no CUI on the equipment, sanitizing or destroying the equipment, or retaining the equipment within the facility.

Assessment Methods

Examine

• maintenance policy and procedures
• procedures for system maintenance tools
• system maintenance tools
• maintenance tool inspection records
• equipment sanitization records
• media sanitization records
• system security plan
• other relevant documents or records

Interview

• personnel with system maintenance responsibilities
• personnel responsible for media sanitization
• personnel with information security responsibilities

Test

• processes for approving, controlling, and monitoring maintenance tools
• mechanisms for supporting or implementing the approval, control, or monitoring of maintenance tools
• processes for preventing the unauthorized removal of information
• processes for inspecting media for malicious code
• mechanisms for supporting media sanitization or the destruction of equipment
• mechanisms for supporting the verification of media sanitization
• processes for inspecting maintenance tools
• mechanisms for supporting or implementing the inspection of maintenance tools
• mechanisms for supporting or implementing the inspection of media used for maintenance

Assessment Objective

Determine if:

• nonlocal maintenance and diagnostic activities are approved.
• nonlocal maintenance and diagnostic activities are monitored.
• session connections are terminated when nonlocal maintenance is completed.
• network connections are terminated when nonlocal maintenance is completed.
• multi-factor authentication is implemented in the establishment of nonlocal maintenance and diagnostic sessions.
• replay resistance is implemented in the establishment of nonlocal maintenance and diagnostic sessions.

Assessment Methods

Examine

• maintenance policy and procedures
• remote access policy and procedures
• procedures for nonlocal system maintenance
• records of remote access
• maintenance records
• diagnostic records
• system design documentation
• system configuration settings
• system security plan
• other relevant documents or records

Interview

• personnel with system maintenance responsibilities
• personnel with information security responsibilities
• system administrators

Test

• processes for managing nonlocal maintenance
• mechanisms for implementing, supporting, or managing nonlocal maintenance
• mechanisms for implementing multi-factor authentication and replay resistance
• mechanisms for terminating nonlocal maintenance sessions and network connections

Assessment Objective

Determine if:

• a process for maintenance personnel authorization is established.
• a list of authorized maintenance organizations or personnel is maintained.
• organizational personnel with required access authorizations are designated to supervise the maintenance activities of personnel who do not possess the required access authorizations.
• organizational personnel with required technical competence are designated to supervise the maintenance activities of personnel who do not possess the required access authorizations.
• non-escorted personnel who perform maintenance on the system possess the required access authorizations.

Assessment Methods

Examine

• maintenance policy and procedures
• service provider contracts
• service-level agreements
• list of authorized personnel
• maintenance records
• access control records
• system security plan
• other relevant documents or records

Interview

• personnel with system maintenance responsibilities
• personnel with information security responsibilities

Test

• processes for authorizing and managing maintenance personnel
• mechanisms for supporting or implementing the authorization of maintenance personnel

Assessment Objective

Determine if:

• system media that contain CUI are physically controlled.
• system media that contain CUI are securely stored.

Assessment Methods

Examine

• physical protection policy and procedures
• media protection policy and procedures
• procedures for media storage
• access control policy and procedures
• system media
• system security plan
• other relevant documents or records

Interview

• personnel with system media protection and storage responsibilities
• personnel with information security responsibilities

Test

• processes for storing information media
• mechanisms for supporting or implementing secure media storage/media protection

Assessment Objective

Determine if:

• access to CUI on system media is restricted to authorized personnel or roles.

Assessment Methods

Examine

• physical protection policy and procedures
• media protection policy and procedures
• procedures for media access restrictions
• access control policy and procedures
• media storage facilities
• access control records
• system security plan
• other relevant documents or records

Interview

• personnel with system media protection responsibilities
• personnel with information security responsibilities
• system administrators

Test

• processes for restricting information on media
• mechanisms for supporting or implementing media access restrictions

Assessment Objective

Determine if:

• system media that contain CUI are sanitized prior to disposal, release out of organizational control, or release for reuse.

Assessment Methods

Examine

• media protection policy and procedures
• procedures for media sanitization and disposal
• applicable standards and policies that address media sanitization policy
• system audit records
• media sanitization records
• system design documentation
• system configuration settings
• records retention and disposition policy
• records retention and disposition procedures
• system security plan
• other relevant documents or records

Interview

• personnel with media sanitization responsibilities
• personnel with records retention and disposition responsibilities
• personnel with information security responsibilities
• system administrators

Test

• processes for media sanitization
• mechanisms for supporting or implementing media sanitization

Assessment Objective

Determine if:

• system media that contain CUI are marked to indicate distribution limitations.
• system media that contain CUI are marked to indicate handling caveats.
• system media that contain CUI are marked to indicate applicable CUI markings.

Assessment Methods

Examine

• physical protection policy and procedures
• media protection policy and procedures
• procedures for media marking
• list of system media marking security attributes
• system security plan
• other relevant documents or records

Interview

• personnel with system media protection and marking responsibilities
• personnel with information security responsibilities

Test

• processes for marking information media
• mechanisms for supporting or implementing media marking

Assessment Objective

Determine if:

• system media that contain CUI are protected during transport outside of controlled areas.
• system media that contain CUI are controlled during transport outside of controlled areas.
• activities associated with the transport of system media that contain CUI are documented.
• accountability for system media that contain CUI is maintained during transport outside of controlled areas.

Assessment Methods

Examine

• physical protection policy and procedures
• media protection policy and procedures
• procedures for media storage
• access control policy and procedures
• authorized personnel list
• system media
• designated controlled areas
• system and communications protection policy and procedures
• cryptographic mechanisms and configuration documentation
• procedures for the protection of information at rest
• system design documentation
• system configuration settings
• list of information at rest requiring confidentiality protections
• system audit records
• system security plan
• other relevant documents or records

Interview

• personnel with system media protection and storage responsibilities
• personnel with information security responsibilities
• system developers
• system administrators

Test

• processes for storing information media
• mechanisms for supporting or implementing media storage/media protection
• mechanisms for supporting or implementing confidentiality protections for information at rest

Assessment Objective

Determine if:

• the use of the following types of system media is restricted or prohibited: [Assignment: types of system media].
• the use of removable system media without an identifiable owner is prohibited.

Assessment Methods

Examine

• system media protection policy and procedures
• system use policy
• procedures for media usage restrictions
• rules of behavior
• system audit records
• system design documentation
• system configuration settings
• system security plan
• other relevant documents or records

Interview

• personnel with system media use responsibilities
• personnel with information security responsibilities
• system administrators

Test

• processes for media use
• mechanisms for restricting or prohibiting the use of system media on systems or system components

Assessment Objective

Determine if:

• cryptographic mechanisms are implemented to prevent the unauthorized disclosure of CUI at backup storage locations.
• the confidentiality of backup information is protected.

Assessment Methods

Examine

• contingency planning policy and procedures
• procedures for system backup
• contingency plan
• system design documentation
• system configuration settings
• system security plan
• other relevant documents or records

Interview

• personnel with system backup responsibilities
• personnel with information security responsibilities

Test

• mechanisms for supporting or implementing the cryptographic protection of backup information

Assessment Objective

Determine if:

• individuals are screened prior to authorizing access to the system.
• individuals are rescreened in accordance with the following conditions: [Assignment: conditions].

Assessment Methods

Examine

• personnel security policy and procedures
• procedures for personnel screening and rescreening
• records of screened personnel
• system security plan
• other relevant documents or records

Interview

• personnel with personnel security responsibilities
• personnel with information security responsibilities

Test

• processes for personnel screening and rescreening

Assessment Objective

Determine if:

• upon termination of individual employment, system access is disabled within [Assignment: time period].
• upon termination of individual employment, authenticators associated with the individual are terminated or revoked.
• upon termination of individual employment, credentials associated with the individual are terminated or revoked.
• upon termination of individual employment, security-related system property is retrieved.
• upon individual reassignment or transfer to other positions in the organization, access authorization is modified to correspond with any changes in operational need.
• upon individual reassignment or transfer to other positions in the organization, the ongoing operational need for current logical and physical access authorizations to the system and facility is reviewed.
• upon individual reassignment or transfer to other positions in the organization, the ongoing operational need for current logical and physical access authorizations to the system and facility is confirmed.

Assessment Methods

Examine

• personnel security policy and procedures
• procedures for personnel termination
• records of personnel transfer actions
• procedures for personnel transfer
• list of system and facility access authorizations
• records of personnel termination actions
• records of terminated or revoked authenticators or credentials
• list of system accounts
• records of exit interviews
• system security plan
• other relevant documents or records

Interview

• personnel with personnel security responsibilities
• personnel with account management responsibilities
• personnel with information security responsibilities
• system administrators

Test

• processes for personnel termination
• processes for personnel transfer
• mechanisms for supporting or implementing personnel transfer notifications
• mechanisms for supporting or implementing personnel termination notifications
• mechanisms for disabling system access and revoking authenticators

Assessment Objective

Determine if:

• a list of individuals with authorized access to the facility where the system resides is developed.
• a list of individuals with authorized access to the facility where the system resides is approved.
• a list of individuals with authorized access to the facility where the system resides is maintained.
• the facility access list is reviewed [Assignment: frequency].
• individuals from the facility access list are removed when access is no longer required.
• authorization credentials for facility access are issued.

Assessment Methods

Examine

• physical protection policy and procedures
• procedures for physical access authorizations
• authorized personnel access list
• physical access list reviews
• physical access termination records
• authorization credentials
• system security plan
• other relevant documents or records

Interview

• personnel with physical access authorization responsibilities
• personnel with physical access to the facility where the system resides
• personnel with information security responsibilities

Test

• processes for physical access authorizations
• mechanisms for supporting or implementing physical access authorizations

Assessment Objective

Determine if:

• physical access to the facility where the system resides is monitored to detect physical security incidents.
• physical security incidents are responded to.
• physical access logs are reviewed [Assignment: frequency] .
• physical access logs are reviewed upon occurrence of [Assignment: events or potential indicators of events].

Assessment Methods

Examine

• physical protection policy and procedures
• procedures for physical access monitoring
• physical access logs or records
• physical access monitoring records
• physical access log reviews
• system security plan
• other relevant documents or records

Interview

• personnel with physical access monitoring responsibilities
• personnel with incident response responsibilities
• personnel with information security responsibilities

Test

• processes for monitoring physical access
• mechanisms for supporting or implementing physical access monitoring
• mechanisms for supporting or implementing the review of physical access logs

Assessment Objective

Determine if:

• alternate work sites allowed for use by employees are determined.
• the following security requirements are employed at alternate work sites: [Assignment: security requirements].

Assessment Methods

Examine

• physical protection policy and procedures
• procedures for alternate work sites for personnel
• list of security requirements for alternate work sites
• assessments of security requirements at alternate work sites
• system security plan
• other relevant documents or records

Interview

• personnel approving the use of alternate work sites
• personnel using alternate work sites
• personnel assessing security requirements at alternate work sites
• personnel with information security responsibilities

Test

• processes for security at alternate work sites
• mechanisms for supporting alternate work sites
• security requirements employed at alternate work sites
• means of communication between personnel at alternate work sites and security personnel

Assessment Objective

Determine if:

• physical access authorizations are enforced at entry and exit points to the facility where the system resides by verifying individual physical access authorizations before granting access.
• physical access authorizations are enforced at entry and exit points to the facility where the system resides by controlling ingress and egress with physical access control systems, devices, or guards.
• physical access audit logs for entry or exit points are maintained.
• visitors are escorted.
• visitor activity is controlled.
• physical access to output devices is controlled to prevent unauthorized individuals from obtaining access to CUI.
• keys, combinations, and other physical access devices are secured.

Assessment Methods

Examine

• physical protection policy and procedures
• procedures for physical access control
• physical access control logs or records
• inventory records of physical access control devices
• system entry and exit points
• records of key and lock combination changes
• storage locations for physical access control devices
• physical access control devices
• list of security safeguards controlling access to designated publicly accessible areas within facility
• system security plan
• other relevant documents or records

Interview

• personnel with physical access control responsibilities
• personnel with information security responsibilities

Test

• processes for physical access control
• mechanisms for supporting or implementing physical access control
• physical access control devices

Assessment Objective

Determine if:

• physical access to system distribution and transmission lines within organizational facilities is controlled.

Assessment Methods

Examine

• physical protection policy and procedures
• procedures for access control for transmission mediums
• system design documentation
• facility communications and wiring diagrams
• list of physical security safeguards applied to system distribution and transmission lines
• procedures for access control for display medium
• facility layout of system components
• list of output devices and associated outputs that require physical access controls
• actual displays from system components
• physical access control logs or records for areas containing output devices and related outputs
• system security plan
• other relevant documents or records

Interview

• personnel with physical access control responsibilities
• personnel with information security responsibilities

Test

• processes for access control for distribution and transmission lines
• mechanisms for supporting or implementing access control for distribution and transmission lines
• processes for access control to output devices
• mechanisms for supporting or implementing access control for output devices

Assessment Objective

Determine if:

• the risk (including supply chain risk) of unauthorized disclosure resulting from the processing, storage, or transmission of CUI is assessed.
• risk assessments are updated [Assignment: frequency].

Assessment Methods

Examine

• risk assessment policy and procedures
• security planning policy and procedures
• procedures for organizational assessments of risk
• risk assessment
• risk assessment results
• risk assessment reviews
• risk assessment updates
• SCRM policy and procedures
• inventory of critical systems, system components, and system services
• procedures for organizational assessments of supply chain risk
• acquisition policy
• SCRM plan
• system security plan
• other relevant documents or records

Interview

• personnel with risk assessment responsibilities
• personnel with SCRM responsibilities
• personnel with security responsibilities

Test

• processes for organizational risk assessments
• mechanisms for supporting or conducting, documenting, reviewing, disseminating, and updating risk assessments
• mechanisms for supporting or conducting, documenting, reviewing, disseminating, and updating supply chain risk assessments

Assessment Objective

Determine if:

• the system is monitored for vulnerabilities [Assignment: frequency].
• the system is scanned for vulnerabilities [Assignment: frequency].
• system vulnerabilities are remediated within [Assignment: response times].
• the system is monitored for vulnerabilities when new vulnerabilities that affect the system are identified.
• the system is scanned for vulnerabilities when new vulnerabilities that affect the system are identified.
• system vulnerabilities to be scanned are updated [Assignment: frequency].
• system vulnerabilities to be scanned are updated when new vulnerabilities are identified and reported.

Assessment Methods

Examine

• risk assessment policy and procedures
• procedures for vulnerability scanning
• patch and vulnerability management records
• vulnerability scanning tools and configuration documentation
• vulnerability scanning results
• risk assessment
• risk assessment report
• system security plan
• other relevant documents or records

Interview

• personnel with risk assessment and vulnerability scanning responsibilities
• personnel with vulnerability scan analysis responsibilities
• personnel with vulnerability remediation responsibilities
• personnel with information security responsibilities
• system administrators

Test

• processes for vulnerability monitoring, scanning, analysis, and remediation
• mechanisms for supporting or implementing vulnerability monitoring, scanning, analysis, and remediation

Assessment Objective

Determine if:

• findings from security assessments are responded to.
• findings from security monitoring are responded to.
• findings from security audits are responded to.

Assessment Methods

Examine

• risk assessment policy
• assessment reports
• system audit records
• event logs
• system security plan
• other relevant documents or records

Interview

• personnel with assessment and auditing responsibilities
• system administrators
• personnel with security responsibilities

Test

• processes for assessments and audits
• mechanisms and tools supporting or implementing assessments and auditing

Assessment Objective

Determine if:

• the security requirements for the system and its environment of operation are assessed [Assignment: frequency] to determine if the requirements have been satisfied.

Assessment Methods

Examine

• security assessment and monitoring policy and procedures
• procedures for security assessment planning
• security assessment plan
• security assessment report
• system security plan
• other relevant documents or records

Interview

• personnel with security assessment responsibilities
• personnel with information security responsibilities

Test

• mechanisms for supporting security assessments, processes for security assessment plan development, or security assessment reporting

Assessment Objective

Determine if:

• a plan of action and milestones for the system is developed to document the planned remediation actions for correcting weaknesses or deficiencies noted during security assessments.
• a plan of action and milestones for the system is developed to reduce or eliminate known system vulnerabilities.
• the existing plan of action and milestones is updated based on the findings from security assessments.
• the existing plan of action and milestones is updated based on the findings from continuous monitoring activities.
• the existing plan of action and milestones is updated based on the findings from audits or reviews.

Assessment Methods

Examine

• security assessment and monitoring policy and procedures
• procedures for plans of action and milestones
• security assessment plan
• security assessment report
• security assessment evidence
• plan of action and milestones
• system security plan
• other relevant documents or records

Interview

• personnel with plans of action and milestones development and implementation responsibilities
• personnel with information security responsibilities

Test

• mechanisms for developing, implementing, and maintaining plans of action and milestones

Assessment Objective

Determine if:

• a system-level continuous monitoring strategy is developed.
• a system-level continuous monitoring strategy is implemented.
• ongoing monitoring is included in the continuous monitoring strategy.
• security assessments are included in the continuous monitoring strategy.

Assessment Methods

Examine

• security assessment and monitoring policy and procedures
• organizational continuous monitoring strategy
• system-level continuous monitoring strategy
• procedures for continuous monitoring of the system
• procedures for configuration management
• security assessment report
• plan of action and milestones
• system monitoring records
• configuration management records
• impact analyses
• status reports
• system security plan
• other relevant documents or records

Interview

• personnel with continuous monitoring responsibilities
• personnel with information security responsibilities
• system administrators

Test

• mechanisms for implementing continuous monitoring
• mechanisms for supporting response actions for assessment and monitoring results
• mechanisms for supporting security status reporting

Assessment Objective

Determine if:

• the exchange of CUI between the system and other systems is approved using [Assignment: SELECTED PARAMETER VALUES].
• the exchange of CUI between the system and other systems is managed using [Assignment: SELECTED PARAMETER VALUES].
• interface characteristics for each system are documented as part of the exchange agreements.
• security requirements for each system are documented as part of the exchange agreements.
• responsibilities for each system are documented as part of the exchange agreements.
• exchange agreements are reviewed [Assignment: frequency] .
• exchange agreements are updated [Assignment: frequency] .

Assessment Methods

Examine

• access control policy and procedures
• procedures for system connections
• system and communications protection policy and procedures
• system interconnection security agreements
• information exchange security agreements
• service-level agreements
• memoranda of understanding or agreements
• non-disclosure agreements
• system design documentation
• enterprise architecture
• security architecture
• system configuration settings
• system security plan
• other relevant documents or records

Interview

• personnel with development, implementation, and approval responsibilities for system interconnection agreements
• personnel who manage systems to which the exchange agreements apply
• personnel with information security responsibilities

Assessment Objective

Determine if:

• communications at external managed interfaces to the system are monitored.
• communications at external managed interfaces to the system are controlled.
• communications at key internal managed interfaces within the system are monitored.
• communications at key internal managed interfaces within the system are controlled.
• subnetworks are implemented for publicly accessible system components that are physically or logically separated from internal networks.
• external system connections are only made through managed interfaces that consist of boundary protection devices arranged in accordance with an organizational security architecture.

Assessment Methods

Examine

• system and communications protection policy and procedures
• procedures for boundary protection
• list of key internal boundaries within the system
• boundary protection hardware and software
• system configuration settings
• security architecture
• system audit records
• system design documentation
• system security plan
• other relevant documents or records

Interview

• personnel with boundary protection responsibilities
• personnel with information security responsibilities
• system developers
• system administrators

Test

• mechanisms for implementing boundary protection capabilities

Assessment Objective

Determine if:

• unauthorized information transfer via shared system resources is prevented.
• unintended information transfer via shared system resources is prevented.

Assessment Methods

Examine

• system and communications protection policy and procedures
• procedures for information protection in shared system resources
• system configuration settings
• system audit records
• system design documentation
• system security plan
• other relevant documents or records

Interview

• personnel with information security responsibilities
• system developers
• system administrators

Test

• mechanisms for preventing the unauthorized and unintended transfer of information via shared system resources

Assessment Objective

Determine if:

• network communications traffic is denied by default.
• network communications traffic is allowed by exception.

Assessment Methods

Examine

• system and communications protection policy and procedures
• procedures for boundary protection
• system design documentation
• system configuration settings
• system audit records
• system security plan
• other relevant documents or records

Interview

• personnel with boundary protection responsibilities
• personnel with information security responsibilities
• system developers
• system administrators

Test

• mechanisms for implementing traffic management at managed interfaces

Assessment Objective

Determine if:

• cryptographic mechanisms are implemented to prevent the unauthorized disclosure of CUI during transmission.
• cryptographic mechanisms are implemented to prevent the unauthorized disclosure of CUI while in storage.

Assessment Methods

Examine

• system and communications protection policy and procedures
• procedures for transmission confidentiality
• procedures for the protection of information at rest
• system design documentation
• system configuration settings
• cryptographic mechanisms and associated configuration documentation
• information in storage requiring confidentiality protection
• system audit records
• system security plan
• other relevant documents or records

Interview

• personnel with information security responsibilities
• system developers
• system administrators

Test

• mechanisms for supporting or implementing transmission confidentiality
• cryptographic mechanisms for supporting or implementing transmission confidentiality
• mechanisms for supporting or implementing confidentiality protection for information in storage
• cryptographic mechanisms for implementing confidentiality protections for information in storage

Assessment Objective

Determine if:

• the network connection associated with a communications session is terminated at the end of the session or after [Assignment: time period] of inactivity.

Assessment Methods

Examine

• system and communications protection policy and procedures
• procedures for network disconnect
• system design documentation
• system configuration settings
• system audit records
• system security plan
• other relevant documents or records

Interview

• personnel with information security responsibilities
• system developers
• system administrators

Test

• mechanisms for supporting or implementing a network disconnect capability

Assessment Objective

Determine if:

• cryptographic keys are established in the system in accordance with the following key management requirements: [Assignment: requirements].
• cryptographic keys are managed in the system in accordance with the following key management requirements: [Assignment: requirements].

Assessment Methods

Examine

• system and communications protection policy and procedures
• procedures for cryptographic key establishment and management
• system design documentation
• system configuration settings
• cryptographic mechanisms
• system audit records
• system security plan
• other relevant documents or records

Interview

• personnel with responsibilities for cryptographic key establishment or management
• personnel with information security responsibilities
• system administrators

Test

• mechanisms for supporting or implementing cryptographic key establishment and management

Assessment Objective

Determine if:

• the following types of cryptography are implemented to protect the confidentiality of CUI: [Assignment: types of cryptography].

Assessment Methods

Examine

• system and communications protection policy and procedures
• procedures for cryptographic protection
• system design documentation
• system configuration settings
• cryptographic module validation certificates
• list of FIPS-validated cryptographic modules
• system audit records
• system security plan
• other relevant documents or records

Interview

• personnel with responsibilities for cryptographic protection
• personnel with information security responsibilities
• system developers
• system administrators

Test

• mechanisms for supporting or implementing cryptographic protection

Assessment Objective

Determine if:

• the remote activation of collaborative computing devices and applications is prohibited with the following exceptions: [Assignment: exceptions].
• an explicit indication of use is provided to users who are physically present at the devices.

Assessment Methods

Examine

• system and communications protection policy and procedures
• procedures for collaborative computing
• access control policy and procedures
• system configuration settings
• system design documentation
• system audit records
• system security plan
• other relevant documents or records

Interview

• personnel with responsibilities for managing collaborative computing devices
• personnel with information security responsibilities
• system developers
• system administrators

Test

• mechanisms for supporting or implementing the management of remote activation of collaborative computing devices
• mechanisms for providing an indication of use of collaborative computing devices

Assessment Objective

Determine if:

• the use of mobile code is authorized.
• the use of mobile code is monitored.
• the use of mobile code is controlled.
• acceptable mobile code is defined.
• acceptable mobile code technologies are defined.

Assessment Methods

Examine

• system and communications protection policy and procedures
• procedures for mobile code
• mobile code implementation policy and procedures
• list of acceptable mobile code and mobile code technologies
• authorization records
• system monitoring records
• system audit records
• system security plan
• other relevant documents or records

Interview

• personnel with responsibilities for managing mobile code
• personnel with information security responsibilities
• system administrators

Test

• processes for authorizing, monitoring, and controlling mobile code
• mechanisms for supporting or implementing the management of mobile code
• mechanisms for supporting or implementing mobile code monitoring

Assessment Objective

Determine if:

• the authenticity of communications sessions is protected.

Assessment Methods

Examine

• system and communications protection policy and procedures
• procedures for session authenticity
• system design documentation
• system configuration settings
• system audit records
• system security plan
• other relevant documents or records

Interview

• personnel with information security responsibilities
• system administrators

Test

• mechanisms for supporting or implementing session authenticity

Assessment Objective

Determine if:

• system flaws are identified.
• system flaws are reported.
• system flaws are corrected.
• security-relevant software updates are installed within [Assignment: time period] of the release of the updates.
• security-relevant firmware updates are installed within [Assignment: time period] of the release of the updates.

Assessment Methods

Examine

• system and information integrity policy and procedures
• procedures for flaw remediation
• procedures for configuration management
• list of recent security flaw remediation actions performed on the system
• list of flaws and vulnerabilities that may potentially affect the system
• test results from the installation of software and firmware updates to correct system flaws
• installation and change control records for security-relevant software and firmware updates
• system security plan
• other relevant documents or records

Interview

• personnel responsible for installing, configuring, or maintaining the system
• personnel responsible for flaw remediation
• personnel with configuration management responsibilities
• personnel with information security responsibilities
• system administrators

Test

• processes for identifying, reporting, and correcting system flaws
• processes for installing software and firmware updates
• mechanisms for supporting or implementing the reporting and correction of system flaws
• mechanisms for supporting or implementing the testing software and firmware updates

Assessment Objective

Determine if:

• malicious code protection mechanisms are implemented at system entry and exit points to detect malicious code.
• malicious code protection mechanisms are implemented at system entry and exit points to eradicate malicious code.
• malicious code protection mechanisms are updated as new releases are available in accordance with configuration management policy and procedures.
• malicious code protection mechanisms are configured to perform scans of the system [Assignment: frequency].
• malicious code protection mechanisms are configured to block malicious code, quarantine malicious code, or take other actions in response to malicious code detection.
• malicious code protection mechanisms are configured to perform real-time scans of files from external sources at endpoints or system entry and exit points as the files are downloaded, opened, or executed.

Assessment Methods

Examine

• system and information integrity policy and procedures
• configuration management policy and procedures
• procedures for malicious code protection
• records of malicious code protection updates
• system design documentation
• system configuration settings
• scan results from malicious code protection mechanisms
• record of actions initiated by malicious code protection mechanisms in response to malicious code detection
• system audit records
• system security plan
• other relevant documents or records

Interview

• personnel responsible for malicious code protection
• personnel with system installation, configuration, or maintenance responsibilities
• personnel with information security responsibilities
• system administrators

Test

• processes for employing, updating, and configuring malicious code protection mechanisms
• processes for addressing the detection of false positives and resulting potential impacts
• mechanisms for supporting or implementing, employing, updating, and configuring malicious code protection mechanisms
• mechanisms for supporting or implementing malicious code scanning and the execution of subsequent actions

Assessment Objective

Determine if:

• system security alerts, advisories, and directives from external organizations are received on an ongoing basis.
• internal security alerts, advisories, and directives are generated, as necessary.
• internal security alerts, advisories, and directives are disseminated, as necessary.

Assessment Objective

Determine if:

• the system is monitored to detect attacks.
• the system is monitored to detect indicators of potential attacks.
• the system is monitored to detect unauthorized connections.
• unauthorized use of the system is identified.
• inbound communications traffic is monitored to detect unusual or unauthorized activities or conditions.
• outbound communications traffic is monitored to detect unusual or unauthorized activities or conditions.

Assessment Methods

Examine

• system and information integrity policy and procedures
• procedures for system monitoring tools and techniques
• continuous monitoring strategy
• facility diagram or layout
• system design documentation
• locations within the system where monitoring devices are deployed
• system configuration settings
• system protocols
• system audit records
• system security plan
• other relevant documents or records

Interview

• personnel with responsibilities for installing, configuring, or maintaining the system
• personnel with system monitoring responsibilities
• personnel with intrusion detection responsibilities
• personnel with information security responsibilities
• system administrators

Test

• processes for intrusion detection and system monitoring
• mechanisms for supporting or implementing system monitoring capabilities
• mechanisms for supporting or implementing intrusion detection and system monitoring capabilities
• mechanisms for supporting or implementing the monitoring of inbound and outbound communications traffic

Assessment Objective

Determine if:

• CUI within the system is managed in accordance with applicable laws, Executive Orders, directives, regulations, policies, standards, guidelines, and operational requirements.
• CUI within the system is retained in accordance with applicable laws, Executive Orders, directives, regulations, policies, standards, guidelines, and operational requirements.
• CUI output from the system is managed in accordance with applicable laws, Executive Orders, directives, regulations, policies, standards, guidelines, and operational requirements.
• CUI output from the system is retained in accordance with applicable laws, Executive Orders, directives, regulations, policies, standards, guidelines, and operational requirements.

Assessment Methods

Examine

• system and information integrity policy and procedures
• laws, Executive Orders, directives, policies, regulations, standards, and operational requirements applicable to information management and retention
• records retention and disposition policy
• records retention and disposition procedures
• media protection policy
• media protection procedures
• audit findings
• system security plan
• other relevant documents or records

Interview

• personnel with information and records management, retention, and disposition responsibilities
• personnel with information security responsibilities
• system administrators

Test

• processes for information management, retention, and disposition
• mechanisms for supporting or implementing information management, retention, and disposition

Assessment Objective

Determine if:

• policies needed to satisfy the security requirements for the protection of CUI are developed and documented.
• policies needed to satisfy the security requirements for the protection of CUI are disseminated to organizational personnel or roles.
• procedures needed to satisfy the security requirements for the protection of CUI are developed and documented.
• procedures needed to satisfy the security requirements for the protection of CUI are disseminated to organizational personnel or roles.
• policies and procedures are reviewed [Assignment: frequency].
• policies and procedures are updated [Assignment: frequency].

Assessment Methods

Examine

• security policies and procedures associated with the protection of CUI
• audit findings
• system security plan
• other relevant documents or records

Interview

• personnel with information security responsibilities

Assessment Objective

Determine if:

• a system security plan that defines the constituent system components is developed.
• a system security plan that identifies the information types processed, stored, and transmitted by the system is developed.
• a system security plan that describes specific threats to the system that are of concern to the organization is developed.
• a system security plan that describes the operational environment for the system and any dependencies on or connections to other systems or system components is developed.
• a system security plan that provides an overview of the security requirements for the system is developed.
• a system security plan that describes the safeguards in place or planned for meeting the security requirements is developed.
• a system security plan that identifies individuals that fulfill system roles and responsibilities is developed.
• a system security plan that includes other relevant information necessary for the protection of CUI is developed.
• the system security plan is reviewed [Assignment: frequency].
• the system security plan is updated [Assignment: frequency].
• the system security plan is protected from unauthorized disclosure.

Assessment Methods

Examine

• security planning policy and procedures
• procedures for system security plan development and implementation
• procedures for system security plan reviews and updates
• enterprise architecture
• system security plan
• records of system security plan reviews and updates
• risk assessments
• risk assessment results
• security architecture and design documentation
• other relevant documents or records

Interview

• personnel with system security planning and plan implementation responsibilities
• system developers
• personnel with information security responsibilities

Test

• processes for system security plan development, review, update, and approval

Assessment Objective

Determine if:

• rules that describe responsibilities and expected behavior for system usage and protecting CUI are established.
• rules are provided to individuals who require access to the system.
• a documented acknowledgement from individuals indicating that they have read, understand, and agree to abide by the rules of behavior is received before authorizing access to CUI and the system.
• the rules of behavior are updated [Assignment: frequency] .
• the rules of behavior are reviewed [Assignment: frequency].

Assessment Methods

Examine

• security planning policy and procedures
• rules of behavior for system users
• signed acknowledgements of rules of behavior
• records for rules of behavior reviews and updates
• system security plan
• other relevant documents or records

Interview

• personnel with rules of behavior establishment, review, and update responsibilities
• personnel with literacy training and awareness responsibilities
• personnel with role-based training responsibilities
• authorized users of the system who have signed rules of behavior
• personnel with information security responsibilities

Test

• processes for establishing, reviewing, disseminating, and updating rules of behavior
• mechanisms for supporting or implementing the establishment, dissemination, review, and update of rules of behavior

Assessment Objective

Determine if:

• [Assignment: systems security engineering principles] are applied to the development or modification of the system and system components.

Assessment Methods

Examine

• system and services acquisition policy
• system and services acquisition procedures
• procedures addressing security engineering principles used in the development and modification of the system
• system design documentation
• security requirements and specifications for the system
• system security plan
• other relevant documents or records

Interview

• personnel with acquisition/contracting responsibilities
• personnel with information security responsibilities
• personnel with system development and modification responsibilities
• system developers

Test

• processes for applying security engineering principles in system development and modification
• mechanisms supporting the application of security engineering principles in system development and modification

Assessment Objective

Determine if:

• options for risk mitigation or alternative sources for continued support for unsupported components that cannot be replaced are provided.
• system components are replaced when support for the components is no longer available from the developer, vendor, or manufacturer.

Assessment Methods

Examine

• system and services acquisition policy and procedures
• procedures for the replacement or continued use of unsupported system components
• documented evidence of replacing unsupported system components
• documented approvals (including justification) for the continued use of unsupported system components
• SCRM plan
• system security plan
• other relevant documents or records

Interview

• personnel with system and service acquisition responsibilities
• personnel responsible for component replacement
• personnel with system development life cycle responsibilities
• personnel with information security responsibilities

Test

• processes for replacing unsupported system components
• mechanisms for supporting or implementing the replacement of unsupported system components

Assessment Objective

Determine if:

• the providers of external system services used for the processing, storage, or transmission of CUI comply with the following security requirements: [Assignment: security requirements].
• processes, methods, and techniques to monitor security requirement compliance by external service providers on an ongoing basis are implemented.
• user roles and responsibilities with regard to external system services, including shared responsibilities with external service providers, are defined and documented.

Assessment Methods

Examine

• system and services acquisition policy and procedures
• procedures for monitoring security requirement compliance by external service providers
• acquisition documentation
• contracts
• service-level agreements
• interagency agreements
• licensing agreements
• list of security requirements for external provider services
• assessment results or reports from external service providers
• SCRM plan
• system security plan
• other relevant documents or records

Interview

• personnel with acquisition responsibilities
• external providers of system services
• personnel with SCRM responsibilities
• personnel with information security responsibilities

Test

• organizational processes for monitoring security and privacy control compliance by external service providers on an ongoing basis
• mechanisms for monitoring security and privacy control compliance by external service providers on an ongoing basis

Assessment Objective

Determine if:

• a plan for managing supply chain risks is developed.
• the SCRM plan addresses risks associated with the research and development of the system, system components, or system services.
• the SCRM plan addresses risks associated with the design of the system, system components, or system services.
• the SCRM plan addresses risks associated with the manufacturing of the system, system components, or system services.
• the SCRM plan addresses risks associated with the acquisition of the system, system components, or system services.
• the SCRM plan addresses risks associated with the delivery of the system, system components, or system services.
• the SCRM plan addresses risks associated with the integration of the system, system components, or system services.
• the SCRM plan addresses risks associated with the operation of the system, system components, or system services.
• the SCRM plan addresses risks associated with the maintenance of the system, system components, or system services.
• the SCRM plan addresses risks associated with the disposal of the system, system components, or system services.
• the SCRM plan is reviewed [Assignment: frequency].
• the SCRM plan is updated [Assignment: frequency].
• the SCRM plan is protected from unauthorized disclosure.

Assessment Methods

Examine

• SCRM policy and procedures
• SCRM plan
• system and services acquisition policy and procedures
• system and services acquisition procedures
• procedures for supply chain protection
• procedures for protecting the SCRM plan from unauthorized disclosure
• system development life cycle procedures
• procedures for the integration of information security requirements into the acquisition process
• acquisition documentation
• service-level agreements
• acquisition contracts for the system, system components, or system services
• list of supply chain threats
• list of safeguards for supply chain threats
• system life cycle documentation, including research and development, design, manufacturing, acquisition, delivery, integration, operations, maintenance, and disposal
• inter-organizational agreements and procedures
• system security plan
• other relevant documents or records

Interview

• personnel with acquisition responsibilities
• personnel with SCRM responsibilities
• personnel with information security responsibilities

Test

• organizational processes for defining and documenting the system development life cycle (SDLC)
• organizational processes for identifying SDLC roles and responsibilities
• organizational processes for integrating SCRM into the SDLC
• mechanisms for supporting or implementing the SDLC

Assessment Objective

Determine if:

• acquisition strategies, contract tools, and procurement methods are developed to identify supply chain risks.
• acquisition strategies, contract tools, and procurement methods are developed to protect against supply chain risks.
• acquisition strategies, contract tools, and procurement methods are developed to mitigate supply chain risks.
• acquisition strategies, contract tools, and procurement methods are implemented to identify supply chain risks.
• acquisition strategies, contract tools, and procurement methods are implemented to protect against supply chain risks.
• acquisition strategies, contract tools, and procurement methods are implemented to mitigate supply chain risks.

Assessment Methods

Examine

• SCRM policy and procedures
• SCRM plan
• system and services acquisition policy and procedures
• procedures for supply chain protection
• procedures for the integration of information security requirements into the acquisition process
• solicitation documentation
• acquisition documentation (including purchase orders)
• service-level agreements
• acquisition contracts for the system, system components, or services
• documentation of identified supply chain risks
• mitigation plans for supply chain risks
• documentation of training, education, and awareness programs for personnel regarding supply chain risk
• system security plan
• other relevant documents or records

Interview

• personnel with acquisition responsibilities
• personnel with SCRM responsibilities
• personnel with information security responsibilities

Test

• processes for defining and employing tailored acquisition strategies, contract tools, and procurement methods
• mechanisms for implementing tailored acquisition strategies, contract tools, and procurement methods

Assessment Objective

Determine if:

• a process for identifying weaknesses or deficiencies in the supply chain elements and processes is established.
• a process for addressing weaknesses or deficiencies in the supply chain elements and processes is established.
• the following security requirements are enforced to protect against supply chain risks to the system, system components, or system services and to limit the harm or consequences of supply chain-related events: [Assignment: security requirements].

Assessment Methods

Examine

• SCRM policy and procedures
• SCRM strategy
• SCRM plan
• systems and critical system components inventory documentation
• system and services acquisition policy and procedures
• procedures for the integration of security requirements into the acquisition process
• solicitation documentation
• acquisition documentation (including purchase orders)
• shipping and handling procedures
• configuration management documentation and records
• acquisition contracts for systems or services
• service-level agreements
• risk register documentation
• system security plan
• other relevant documents or records

Interview

• personnel with acquisition responsibilities
• personnel with information security responsibilities
• personnel with SCRM responsibilities

Test

• processes for identifying and addressing supply chain element and process deficiencies