Assessment Objective

Determine if:

• SC-42a. [Selection (one or more): the use of devices possessing [Assignment: environmental sensing capabilities] in [Assignment: facilities, areas, or systems] ; the remote activation of environmental sensing capabilities on organizational systems or system components with the following exceptions: [Assignment: exceptions where remote activation of sensors is allowed] ] is/are prohibited;
• SC-42b. an explicit indication of sensor use is provided to [Assignment: group of users].

Assessment Methods

Examine

• System and communications protection policy
• procedures addressing sensor capabilities and data collection
• access control policy and procedures
• system design documentation
• system configuration settings and associated documentation
• system audit records
• system security plan
• privacy plan
• other relevant documents or records

Interview

• System/network administrators
• organizational personnel with information security and privacy responsibilities
• system developer
• organizational personnel installing, configuring, and/or maintaining the system
• organizational personnel responsible for sensor capabilities

Test

• Mechanisms implementing access controls for the remote activation of system sensor capabilities
• mechanisms implementing the capability to indicate sensor use

Ticket collegati

• NIST -

  https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final