Assessment Objective

Determine if:

• usage restrictions are established for mobile devices.
• configuration requirements are established for mobile devices.
• connection requirements are established for mobile devices.
• the connection of mobile devices to the system is authorized.
• full-device or container-based encryption is implemented to protect the confidentiality of CUI on mobile devices.

Assessment Methods

Examine

• access control policy and procedures
• procedures for mobile device access control
• system design documentation
• configuration management plan
• system configuration settings
• authorizations for mobile device connections to organizational systems
• system audit records
• encryption mechanisms and associated configuration documentation
• system security plan
• other relevant documents or records

Interview

• personnel with access control responsibilities for mobile devices
• personnel using mobile devices to access organizational systems
• personnel with information security responsibilities
• system administrators

Test

• access control capability for mobile device connections to organizational systems
• encryption mechanisms for protecting the confidentiality of CUI on mobile devices
• configurations of mobile devices

Ticket collegati

• NIST -

  https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final