+CA Assessment, Authorization, and Monitoring
---+CA-01 Policy and Procedures
---+CA-02 Control Assessments
------+CA-02(01) Independent Assessors
------+CA-02(02) Specialized Assessments
------+CA-02(03) Leveraging Results from External Organizations
---+CA-03 Information Exchange
------+CA-03(06) Transfer Authorizations
------+CA-03(07) Transitive Information Exchanges
---+CA-04 Security Certification
---+CA-05 Plan of Action and Milestones
------+CA-05(01) Automation Support for Accuracy and Currency
---+CA-06 Authorization
------+CA-06(01) Joint Authorization — Intra-organization
------+CA-06(02) Joint Authorization — Inter-organization
---+CA-07 Continuous Monitoring
------+CA-07(01) Independent Assessment
------+CA-07(03) Trend Analyses
------+CA-07(04) Risk Monitoring
------+CA-07(05) Consistency Analysis
------+CA-07(06) Automation Support for Monitoring
---+CA-08 Penetration Testing
------+CA-08(01) Independent Penetration Testing Agent or Team
------+CA-08(02) Red Team Exercises
------+CA-08(03) Facility Penetration Testing
---+CA-09 Internal System Connections
------+CA-09(01) Compliance Checks

CA Assessment, Authorization, and Monitoring

Assessment, Authorization, and Monitoring

1. Ħarsa ġenerali

CA-01 Policy and Procedures

Control

  1. Develop, document, and disseminate to [Assignement: organization-defined personnel or roles]:
    1. [Selection(one-or-more): organization-level; mission/business process-level; system-level] assessment, authorization, and monitoring policy that:
      1. Addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance; and
      2. Is consistent with applicable laws, executive orders, directives, regulations, policies, standards, and guidelines; and
    2. Procedures to facilitate the implementation of the assessment, authorization, and monitoring policy and the associated assessment, authorization, and monitoring controls;
  2. Designate an [Assignement: official] to manage the development, documentation, and dissemination of the assessment, authorization, and monitoring policy and procedures; and
  3. Review and update the current assessment, authorization, and monitoring:
    1. Policy [Assignement: frequency] and following [Assignement: events] ; and
    2. Procedures [Assignement: frequency] and following [Assignement: events].

Discussion

Assessment, authorization, and monitoring policy and procedures address the controls in the CA family that are implemented within systems and organizations. The risk management strategy is an important factor in establishing such policies and procedures. Policies and procedures contribute to security and privacy assurance. Therefore, it is important that security and privacy programs collaborate on the development of assessment, authorization, and monitoring policy and procedures. Security and privacy program policies and procedures at the organization level are preferable, in general, and may obviate the need for mission- or system-specific policies and procedures. The policy can be included as part of the general security and privacy policy or be represented by multiple policies that reflect the complex nature of organizations. Procedures can be established for security and privacy programs, for mission or business processes, and for systems, if needed. Procedures describe how the policies or controls are implemented and can be directed at the individual or role that is the object of the procedure. Procedures can be documented in system security and privacy plans or in one or more separate documents. Events that may precipitate an update to assessment, authorization, and monitoring policy and procedures include assessment or audit findings, security incidents or breaches, or changes in applicable laws, executive orders, directives, regulations, policies, standards, and guidelines. Simply restating controls does not constitute an organizational policy or procedure.

Assessment Objective

    1. an assessment, authorization, and monitoring policy is developed and documented;
    2. the assessment, authorization, and monitoring policy is disseminated to [Assignement: personnel or roles];
    3. assessment, authorization, and monitoring procedures to facilitate the implementation of the assessment, authorization, and monitoring policy and associated assessment, authorization, and monitoring controls are developed and documented;
    4. the assessment, authorization, and monitoring procedures are disseminated to [Assignement: personnel or roles];
        1. the [Selection(one-or-more): organization-level; mission/business process-level; system-level] assessment, authorization, and monitoring policy addresses purpose;
        2. the [Selection(one-or-more): organization-level; mission/business process-level; system-level] assessment, authorization, and monitoring policy addresses scope;
        3. the [Selection(one-or-more): organization-level; mission/business process-level; system-level] assessment, authorization, and monitoring policy addresses roles;
        4. the [Selection(one-or-more): organization-level; mission/business process-level; system-level] assessment, authorization, and monitoring policy addresses responsibilities;
        5. the [Selection(one-or-more): organization-level; mission/business process-level; system-level] assessment, authorization, and monitoring policy addresses management commitment;
        6. the [Selection(one-or-more): organization-level; mission/business process-level; system-level] assessment, authorization, and monitoring policy addresses coordination among organizational entities;
        7. the [Selection(one-or-more): organization-level; mission/business process-level; system-level] assessment, authorization, and monitoring policy addresses compliance;
      2. the [Selection(one-or-more): organization-level; mission/business process-level; system-level] assessment, authorization, and monitoring policy is consistent with applicable laws, executive orders, directives, regulations, policies, standards, and guidelines;
  2. the [Assignement: official] is designated to manage the development, documentation, and dissemination of the assessment, authorization, and monitoring policy and procedures;
      1. the current assessment, authorization, and monitoring policy is reviewed and updated [Assignement: frequency];
      2. the current assessment, authorization, and monitoring policy is reviewed and updated following [Assignement: events];
      1. the current assessment, authorization, and monitoring procedures are reviewed and updated [Assignement: frequency];
      2. the current assessment, authorization, and monitoring procedures are reviewed and updated following [Assignement: events].

Assessment Method

Examine

Assessment, authorization, and monitoring policy and procedures system security plan privacy plan other relevant documents or records

Interview

Organizational personnel with assessment, authorization, and monitoring policy responsibilities organizational personnel with information security and privacy responsibilities
CA-02 Control Assessments

Control

  1. Select the appropriate assessor or assessment team for the type of assessment to be conducted;
  2. Develop a control assessment plan that describes the scope of the assessment including:
    1. Controls and control enhancements under assessment;
    2. Assessment procedures to be used to determine control effectiveness; and
    3. Assessment environment, assessment team, and assessment roles and responsibilities;
  3. Ensure the control assessment plan is reviewed and approved by the authorizing official or designated representative prior to conducting the assessment;
  4. Assess the controls in the system and its environment of operation [Assignement: assessment frequency] to determine the extent to which the controls are implemented correctly, operating as intended, and producing the desired outcome with respect to meeting established security and privacy requirements;
  5. Produce a control assessment report that document the results of the assessment; and
  6. Provide the results of the control assessment to [Assignement: individuals or roles].

Discussion

Organizations ensure that control assessors possess the required skills and technical expertise to develop effective assessment plans and to conduct assessments of system-specific, hybrid, common, and program management controls, as appropriate. The required skills include general knowledge of risk management concepts and approaches as well as comprehensive knowledge of and experience with the hardware, software, and firmware system components implemented. Organizations assess controls in systems and the environments in which those systems operate as part of initial and ongoing authorizations, continuous monitoring, FISMA annual assessments, system design and development, systems security engineering, privacy engineering, and the system development life cycle. Assessments help to ensure that organizations meet information security and privacy requirements, identify weaknesses and deficiencies in the system design and development process, provide essential information needed to make risk-based decisions as part of authorization processes, and comply with vulnerability mitigation procedures. Organizations conduct assessments on the implemented controls as documented in security and privacy plans. Assessments can also be conducted throughout the system development life cycle as part of systems engineering and systems security engineering processes. The design for controls can be assessed as RFPs are developed, responses assessed, and design reviews conducted. If a design to implement controls and subsequent implementation in accordance with the design are assessed during development, the final control testing can be a simple confirmation utilizing previously completed control assessment and aggregating the outcomes. Organizations may develop a single, consolidated security and privacy assessment plan for the system or maintain separate plans. A consolidated assessment plan clearly delineates the roles and responsibilities for control assessment. If multiple organizations participate in assessing a system, a coordinated approach can reduce redundancies and associated costs. Organizations can use other types of assessment activities, such as vulnerability scanning and system monitoring, to maintain the security and privacy posture of systems during the system life cycle. Assessment reports document assessment results in sufficient detail, as deemed necessary by organizations, to determine the accuracy and completeness of the reports and whether the controls are implemented correctly, operating as intended, and producing the desired outcome with respect to meeting requirements. Assessment results are provided to the individuals or roles appropriate for the types of assessments being conducted. For example, assessments conducted in support of authorization decisions are provided to authorizing officials, senior agency officials for privacy, senior agency information security officers, and authorizing official designated representatives. To satisfy annual assessment requirements, organizations can use assessment results from the following sources: initial or ongoing system authorizations, continuous monitoring, systems engineering processes, or system development life cycle activities. Organizations ensure that assessment results are current, relevant to the determination of control effectiveness, and obtained with the appropriate level of assessor independence. Existing control assessment results can be reused to the extent that the results are still valid and can also be supplemented with additional assessments as needed. After the initial authorizations, organizations assess controls during continuous monitoring. Organizations also establish the frequency for ongoing assessments in accordance with organizational continuous monitoring strategies. External audits, including audits by external entities such as regulatory agencies, are outside of the scope of [CA-2](#ca-2).

Assessment Objective

  1. an appropriate assessor or assessment team is selected for the type of assessment to be conducted;
    1. a control assessment plan is developed that describes the scope of the assessment, including controls and control enhancements under assessment;
    2. a control assessment plan is developed that describes the scope of the assessment, including assessment procedures to be used to determine control effectiveness;
      1. a control assessment plan is developed that describes the scope of the assessment, including the assessment environment;
      2. a control assessment plan is developed that describes the scope of the assessment, including the assessment team;
      3. a control assessment plan is developed that describes the scope of the assessment, including assessment roles and responsibilities;
  3. the control assessment plan is reviewed and approved by the authorizing official or designated representative prior to conducting the assessment;
    1. controls are assessed in the system and its environment of operation [Assignement: assessment frequency] to determine the extent to which the controls are implemented correctly, operating as intended, and producing the desired outcome with respect to meeting established security requirements;
    2. controls are assessed in the system and its environment of operation [Assignement: assessment frequency] to determine the extent to which the controls are implemented correctly, operating as intended, and producing the desired outcome with respect to meeting established privacy requirements;
  5. a control assessment report is produced that documents the results of the assessment;
  6. the results of the control assessment are provided to [Assignement: individuals or roles].

Assessment Method

Examine

Assessment, authorization, and monitoring policy procedures addressing assessment planning procedures addressing control assessments control assessment plan control assessment report system security plan privacy plan other relevant documents or records

Interview

Organizational personnel with control assessment responsibilities organizational personnel with information security and privacy responsibilities
CA-03 Information Exchange

Control

  1. Approve and manage the exchange of information between the system and other systems using [Selection(one-or-more): interconnection security agreements; information exchange security agreements; memoranda of understanding or agreement; service level agreements; user agreements; non-disclosure agreements; {{ insert: param, ca-03_odp.02 }} ];
  2. Document, as part of each exchange agreement, the interface characteristics, security and privacy requirements, controls, and responsibilities for each system, and the impact level of the information communicated; and
  3. Review and update the agreements [Assignement: frequency].

Discussion

System information exchange requirements apply to information exchanges between two or more systems. System information exchanges include connections via leased lines or virtual private networks, connections to internet service providers, database sharing or exchanges of database transaction information, connections and exchanges with cloud services, exchanges via web-based services, or exchanges of files via file transfer protocols, network protocols (e.g., IPv4, IPv6), email, or other organization-to-organization communications. Organizations consider the risk related to new or increased threats that may be introduced when systems exchange information with other systems that may have different security and privacy requirements and controls. This includes systems within the same organization and systems that are external to the organization. A joint authorization of the systems exchanging information, as described in [CA-6(1)](#ca-6.1) or [CA-6(2)](#ca-6.2) , may help to communicate and reduce risk. Authorizing officials determine the risk associated with system information exchange and the controls needed for appropriate risk mitigation. The types of agreements selected are based on factors such as the impact level of the information being exchanged, the relationship between the organizations exchanging information (e.g., government to government, government to business, business to business, government or business to service provider, government or business to individual), or the level of access to the organizational system by users of the other system. If systems that exchange information have the same authorizing official, organizations need not develop agreements. Instead, the interface characteristics between the systems (e.g., how the information is being exchanged. how the information is protected) are described in the respective security and privacy plans. If the systems that exchange information have different authorizing officials within the same organization, the organizations can develop agreements or provide the same information that would be provided in the appropriate agreement type from [CA-3a](#ca-3_smt.a) in the respective security and privacy plans for the systems. Organizations may incorporate agreement information into formal contracts, especially for information exchanges established between federal agencies and nonfederal organizations (including service providers, contractors, system developers, and system integrators). Risk considerations include systems that share the same networks.

Assessment Objective

  1. the exchange of information between the system and other systems is approved and managed using [Selection(one-or-more): interconnection security agreements; information exchange security agreements; memoranda of understanding or agreement; service level agreements; user agreements; non-disclosure agreements; {{ insert: param, ca-03_odp.02 }} ];
    1. the interface characteristics are documented as part of each exchange agreement;
    2. security requirements are documented as part of each exchange agreement;
    3. privacy requirements are documented as part of each exchange agreement;
    4. controls are documented as part of each exchange agreement;
    5. responsibilities for each system are documented as part of each exchange agreement;
    6. the impact level of the information communicated is documented as part of each exchange agreement;
  3. agreements are reviewed and updated [Assignement: frequency].

Assessment Method

Examine

Access control policy procedures addressing system connections system and communications protection policy system interconnection security agreements information exchange security agreements memoranda of understanding or agreements service level agreements non-disclosure agreements system design documentation enterprise architecture system architecture system configuration settings and associated documentation system security plan privacy plan other relevant documents or records

Interview

Organizational personnel with responsibilities for developing, implementing, or approving system interconnection agreements organizational personnel with information security and privacy responsibilities personnel managing the system(s) to which the interconnection security agreement applies
CA-04 Security Certification

Control

Discussion

Assessment Objective

Assessment Method

Examine

Interview
CA-05 Plan of Action and Milestones

Control

  1. Develop a plan of action and milestones for the system to document the planned remediation actions of the organization to correct weaknesses or deficiencies noted during the assessment of the controls and to reduce or eliminate known vulnerabilities in the system; and
  2. Update existing plan of action and milestones [Assignement: frequency] based on the findings from control assessments, independent audits or reviews, and continuous monitoring activities.

Discussion

Plans of action and milestones are useful for any type of organization to track planned remedial actions. Plans of action and milestones are required in authorization packages and subject to federal reporting requirements established by OMB.

Assessment Objective

  1. a plan of action and milestones for the system is developed to document the planned remediation actions of the organization to correct weaknesses or deficiencies noted during the assessment of the controls and to reduce or eliminate known vulnerabilities in the system;
  2. existing plan of action and milestones are updated [Assignement: frequency] based on the findings from control assessments, independent audits or reviews, and continuous monitoring activities.

Assessment Method

Examine

Assessment, authorization, and monitoring policy procedures addressing plan of action and milestones control assessment plan control assessment report control assessment evidence plan of action and milestones system security plan privacy plan other relevant documents or records

Interview

Organizational personnel with plan of action and milestones development and implementation responsibilities organizational personnel with information security and privacy responsibilities
CA-06 Authorization

Control

  1. Assign a senior official as the authorizing official for the system;
  2. Assign a senior official as the authorizing official for common controls available for inheritance by organizational systems;
  3. Ensure that the authorizing official for the system, before commencing operations:
    1. Accepts the use of common controls inherited by the system; and
    2. Authorizes the system to operate;
  4. Ensure that the authorizing official for common controls authorizes the use of those controls for inheritance by organizational systems;
  5. Update the authorizations [Assignement: frequency].

Discussion

Authorizations are official management decisions by senior officials to authorize operation of systems, authorize the use of common controls for inheritance by organizational systems, and explicitly accept the risk to organizational operations and assets, individuals, other organizations, and the Nation based on the implementation of agreed-upon controls. Authorizing officials provide budgetary oversight for organizational systems and common controls or assume responsibility for the mission and business functions supported by those systems or common controls. The authorization process is a federal responsibility, and therefore, authorizing officials must be federal employees. Authorizing officials are both responsible and accountable for security and privacy risks associated with the operation and use of organizational systems. Nonfederal organizations may have similar processes to authorize systems and senior officials that assume the authorization role and associated responsibilities. Authorizing officials issue ongoing authorizations of systems based on evidence produced from implemented continuous monitoring programs. Robust continuous monitoring programs reduce the need for separate reauthorization processes. Through the employment of comprehensive continuous monitoring processes, the information contained in authorization packages (i.e., security and privacy plans, assessment reports, and plans of action and milestones) is updated on an ongoing basis. This provides authorizing officials, common control providers, and system owners with an up-to-date status of the security and privacy posture of their systems, controls, and operating environments. To reduce the cost of reauthorization, authorizing officials can leverage the results of continuous monitoring processes to the maximum extent possible as the basis for rendering reauthorization decisions.

Assessment Objective

  1. a senior official is assigned as the authorizing official for the system;
  2. a senior official is assigned as the authorizing official for common controls available for inheritance by organizational systems;
    1. before commencing operations, the authorizing official for the system accepts the use of common controls inherited by the system;
    2. before commencing operations, the authorizing official for the system authorizes the system to operate;
  4. the authorizing official for common controls authorizes the use of those controls for inheritance by organizational systems;
  5. the authorizations are updated [Assignement: frequency].

Assessment Method

Examine

Assessment, authorization, and monitoring policy procedures addressing authorization system security plan, privacy plan, assessment report, plan of action and milestones authorization statement other relevant documents or records

Interview

Organizational personnel with authorization responsibilities organizational personnel with information security and privacy responsibilities
CA-07 Continuous Monitoring

Control

Develop a system-level continuous monitoring strategy and implement continuous monitoring in accordance with the organization-level continuous monitoring strategy that includes:
  1. Establishing the following system-level metrics to be monitored: [Assignement: system-level metrics];
  2. Establishing [Assignement: frequencies] for monitoring and [Assignement: frequencies] for assessment of control effectiveness;
  3. Ongoing control assessments in accordance with the continuous monitoring strategy;
  4. Ongoing monitoring of system and organization-defined metrics in accordance with the continuous monitoring strategy;
  5. Correlation and analysis of information generated by control assessments and monitoring;
  6. Response actions to address results of the analysis of control assessment and monitoring information; and
  7. Reporting the security and privacy status of the system to [Assignement: organization-defined personnel or roles] [Assignement: organization-defined frequency].

Discussion

Continuous monitoring at the system level facilitates ongoing awareness of the system security and privacy posture to support organizational risk management decisions. The terms "continuous" and "ongoing" imply that organizations assess and monitor their controls and risks at a frequency sufficient to support risk-based decisions. Different types of controls may require different monitoring frequencies. The results of continuous monitoring generate risk response actions by organizations. When monitoring the effectiveness of multiple controls that have been grouped into capabilities, a root-cause analysis may be needed to determine the specific control that has failed. Continuous monitoring programs allow organizations to maintain the authorizations of systems and common controls in highly dynamic environments of operation with changing mission and business needs, threats, vulnerabilities, and technologies. Having access to security and privacy information on a continuing basis through reports and dashboards gives organizational officials the ability to make effective and timely risk management decisions, including ongoing authorization decisions. Automation supports more frequent updates to hardware, software, and firmware inventories, authorization packages, and other system information. Effectiveness is further enhanced when continuous monitoring outputs are formatted to provide information that is specific, measurable, actionable, relevant, and timely. Continuous monitoring activities are scaled in accordance with the security categories of systems. Monitoring requirements, including the need for specific monitoring, may be referenced in other controls and control enhancements, such as [AC-2g](#ac-2_smt.g), [AC-2(7)](#ac-2.7), [AC-2(12)(a)](#ac-2.12_smt.a), [AC-2(7)(b)](#ac-2.7_smt.b), [AC-2(7)(c)](#ac-2.7_smt.c), [AC-17(1)](#ac-17.1), [AT-4a](#at-4_smt.a), [AU-13](#au-13), [AU-13(1)](#au-13.1), [AU-13(2)](#au-13.2), [CM-3f](#cm-3_smt.f), [CM-6d](#cm-6_smt.d), [CM-11c](#cm-11_smt.c), [IR-5](#ir-5), [MA-2b](#ma-2_smt.b), [MA-3a](#ma-3_smt.a), [MA-4a](#ma-4_smt.a), [PE-3d](#pe-3_smt.d), [PE-6](#pe-6), [PE-14b](#pe-14_smt.b), [PE-16](#pe-16), [PE-20](#pe-20), [PM-6](#pm-6), [PM-23](#pm-23), [PM-31](#pm-31), [PS-7e](#ps-7_smt.e), [SA-9c](#sa-9_smt.c), [SR-4](#sr-4), [SC-5(3)(b)](#sc-5.3_smt.b), [SC-7a](#sc-7_smt.a), [SC-7(24)(b)](#sc-7.24_smt.b), [SC-18b](#sc-18_smt.b), [SC-43b](#sc-43_smt.b) , and [SI-4](#si-4).

Assessment Objective

  1. a system-level continuous monitoring strategy is developed;
  2. system-level continuous monitoring is implemented in accordance with the organization-level continuous monitoring strategy;
  3. system-level continuous monitoring includes establishment of the following system-level metrics to be monitored: [Assignement: system-level metrics];
    1. system-level continuous monitoring includes established [Assignement: frequencies] for monitoring;
    2. system-level continuous monitoring includes established [Assignement: frequencies] for assessment of control effectiveness;
  5. system-level continuous monitoring includes ongoing control assessments in accordance with the continuous monitoring strategy;
  6. system-level continuous monitoring includes ongoing monitoring of system and organization-defined metrics in accordance with the continuous monitoring strategy;
  7. system-level continuous monitoring includes correlation and analysis of information generated by control assessments and monitoring;
  8. system-level continuous monitoring includes response actions to address the results of the analysis of control assessment and monitoring information;
    1. system-level continuous monitoring includes reporting the security status of the system to [Assignement: personnel or roles] [Assignement: frequency];
    2. system-level continuous monitoring includes reporting the privacy status of the system to [Assignement: personnel or roles] [Assignement: frequency].

Assessment Method

Examine

Assessment, authorization, and monitoring policy organizational continuous monitoring strategy system-level continuous monitoring strategy procedures addressing continuous monitoring of system controls procedures addressing configuration management control assessment report plan of action and milestones system monitoring records configuration management records impact analyses status reports system security plan privacy plan other relevant documents or records

Interview

Organizational personnel with continuous monitoring responsibilities organizational personnel with information security and privacy responsibilities system/network administrators
CA-08 Penetration Testing

Control

Conduct penetration testing [Assignement: frequency] on [Assignement: system(s) or system components].

Discussion

Penetration testing is a specialized type of assessment conducted on systems or individual system components to identify vulnerabilities that could be exploited by adversaries. Penetration testing goes beyond automated vulnerability scanning and is conducted by agents and teams with demonstrable skills and experience that include technical expertise in network, operating system, and/or application level security. Penetration testing can be used to validate vulnerabilities or determine the degree of penetration resistance of systems to adversaries within specified constraints. Such constraints include time, resources, and skills. Penetration testing attempts to duplicate the actions of adversaries and provides a more in-depth analysis of security- and privacy-related weaknesses or deficiencies. Penetration testing is especially important when organizations are transitioning from older technologies to newer technologies (e.g., transitioning from IPv4 to IPv6 network protocols). Organizations can use the results of vulnerability analyses to support penetration testing activities. Penetration testing can be conducted internally or externally on the hardware, software, or firmware components of a system and can exercise both physical and technical controls. A standard method for penetration testing includes a pretest analysis based on full knowledge of the system, pretest identification of potential vulnerabilities based on the pretest analysis, and testing designed to determine the exploitability of vulnerabilities. All parties agree to the rules of engagement before commencing penetration testing scenarios. Organizations correlate the rules of engagement for the penetration tests with the tools, techniques, and procedures that are anticipated to be employed by adversaries. Penetration testing may result in the exposure of information that is protected by laws or regulations, to individuals conducting the testing. Rules of engagement, contracts, or other appropriate mechanisms can be used to communicate expectations for how to protect this information. Risk assessments guide the decisions on the level of independence required for the personnel conducting penetration testing.

Assessment Objective

penetration testing is conducted [Assignement: frequency] on [Assignement: system(s) or system components].

Assessment Method

Examine

Assessment, authorization, and monitoring policy procedures addressing penetration testing assessment plan penetration test report assessment report assessment evidence system security plan privacy plan other relevant documents or records

Interview

Organizational personnel with control assessment responsibilities organizational personnel with information security and privacy responsibilities system/network administrators
CA-09 Internal System Connections

Control

  1. Authorize internal connections of [Assignement: system components] to the system;
  2. Document, for each internal connection, the interface characteristics, security and privacy requirements, and the nature of the information communicated;
  3. Terminate internal system connections after [Assignement: conditions] ; and
  4. Review [Assignement: frequency] the continued need for each internal connection.

Discussion

Internal system connections are connections between organizational systems and separate constituent system components (i.e., connections between components that are part of the same system) including components used for system development. Intra-system connections include connections with mobile devices, notebook and desktop computers, tablets, printers, copiers, facsimile machines, scanners, sensors, and servers. Instead of authorizing each internal system connection individually, organizations can authorize internal connections for a class of system components with common characteristics and/or configurations, including printers, scanners, and copiers with a specified processing, transmission, and storage capability or smart phones and tablets with a specific baseline configuration. The continued need for an internal system connection is reviewed from the perspective of whether it provides support for organizational missions or business functions.

Assessment Objective

  1. internal connections of [Assignement: system components] to the system are authorized;
    1. for each internal connection, the interface characteristics are documented;
    2. for each internal connection, the security requirements are documented;
    3. for each internal connection, the privacy requirements are documented;
    4. for each internal connection, the nature of the information communicated is documented;
  3. internal system connections are terminated after [Assignement: conditions];
  4. the continued need for each internal connection is reviewed [Assignement: frequency].

Assessment Method

Examine

Assessment, authorization, and monitoring policy access control policy procedures addressing system connections system and communications protection policy system design documentation system configuration settings and associated documentation list of components or classes of components authorized as internal system connections assessment report system audit records system security plan privacy plan other relevant documents or records

Interview

Organizational personnel with responsibilities for developing, implementing, or authorizing internal system connections organizational personnel with information security and privacy responsibilities

1.1 Referenzi

1.2 Rekwiżiti identifikati

1.3 Regolamenti relatati

2. Rekwiżiti identifikati

Rekwiżiti

3. Regolamenti relatati

Regolamenti