Assessment Objective

Determine if:

• AC-17(04)(a)
  • AC-17(04)(a)[01] the execution of privileged commands via remote access is authorized only in a format that provides assessable evidence;
  • AC-17(04)(a)[02] access to security-relevant information via remote access is authorized only in a format that provides assessable evidence;
  • AC-17(04)(a)[03] the execution of privileged commands via remote access is authorized only for the following needs: [Assignment: needs requiring remote access];
  • AC-17(04)(a)[04] access to security-relevant information via remote access is authorized only for the following needs: [Assignment: needs requiring remote access];
• AC-17(04)(b) the rationale for remote access is documented in the security plan for the system.

Assessment Methods

Examine

• Access control policy
• procedures addressing remote access to the system
• system configuration settings and associated documentation
• security plan
• system audit records
• system security plan
• other relevant documents or records

Interview

• System/network administrators
• organizational personnel with information security responsibilities

Test

• Mechanisms implementing remote access management

Ticket collegati

• NIST -

  https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final