Assessment Objective

Determine if:

• approved authorizations are enforced for controlling the flow of CUI within the system.
• approved authorizations are enforced for controlling the flow of CUI between connected systems.

Assessment Methods

Examine

• access control policy and procedures
• information flow control policies
• procedures for information flow enforcement
• security architecture and design documentation
• system configuration settings
• system baseline configuration
• system audit records
• list of information flow authorizations
• system security plan
• other relevant documents or records

Interview

• system administrators
• personnel with security architecture responsibilities
• personnel with information security responsibilities
• system developers

Test

• mechanisms for implementing the information flow enforcement policy

Kwistjonijiet marbuta

• NIST -

  https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final