Assessment Objective

Determine if:

• AC-17a.
  • AC-17a.[01] usage restrictions are established and documented for each type of remote access allowed;
  • AC-17a.[02] configuration/connection requirements are established and documented for each type of remote access allowed;
  • AC-17a.[03] implementation guidance is established and documented for each type of remote access allowed;
• AC-17b. each type of remote access to the system is authorized prior to allowing such connections.

Assessment Methods

Examine

• Access control policy
• procedures addressing remote access implementation and usage (including restrictions)
• configuration management plan
• system configuration settings and associated documentation
• remote access authorizations
• system audit records
• system security plan
• other relevant documents or records

Interview

• Organizational personnel with responsibilities for managing remote access connections
• system/network administrators
• organizational personnel with information security responsibilities

Test

• Remote access management capability for the system

Gekoppelde issues

• NIST -

  https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final