Assessment Objective

Determine if:

• cryptographic mechanisms are implemented to prevent the unauthorized disclosure of CUI during transmission.
• cryptographic mechanisms are implemented to prevent the unauthorized disclosure of CUI while in storage.

Assessment Methods

Examine

• system and communications protection policy and procedures
• procedures for transmission confidentiality
• procedures for the protection of information at rest
• system design documentation
• system configuration settings
• cryptographic mechanisms and associated configuration documentation
• information in storage requiring confidentiality protection
• system audit records
• system security plan
• other relevant documents or records

Interview

• personnel with information security responsibilities
• system developers
• system administrators

Test

• mechanisms for supporting or implementing transmission confidentiality
• cryptographic mechanisms for supporting or implementing transmission confidentiality
• mechanisms for supporting or implementing confidentiality protection for information in storage
• cryptographic mechanisms for implementing confidentiality protections for information in storage

Ticket collegati

• NIST -

  https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final