Assessment Objective
Determine if:
- AC-19a.
- AC-19a.[01] configuration requirements are established for organization-controlled mobile devices, including when such devices are outside of the controlled area;
- AC-19a.[02] connection requirements are established for organization-controlled mobile devices, including when such devices are outside of the controlled area;
- AC-19a.[03] implementation guidance is established for organization-controlled mobile devices, including when such devices are outside of the controlled area;
- AC-19b. the connection of mobile devices to organizational systems is authorized.
Assessment Methods
Examine
- Access control policy
- procedures addressing access control for mobile device usage (including restrictions)
- configuration management plan
- system design documentation
- system configuration settings and associated documentation
- authorizations for mobile device connections to organizational systems
- system audit records
- system security plan
- other relevant documents or records
Interview
- Organizational personnel using mobile devices to access organizational systems
- system/network administrators
- organizational personnel with information security responsibilities
Test
- Access control capability for mobile device connections to organizational systems
- configurations of mobile devices
Gekoppelde issues
| Koppelingstype | Issue |
|---|---|
| blocks | AC-19 [H] Access Control for Mobile Devices |