Assessment Objective

Determine if:

• CM-02(07)(a) [Assignment: systems or system components] with [Assignment: configurations] are issued to individuals traveling to locations that the organization deems to be of significant risk;
• CM-02(07)(b) [Assignment: controls] are applied to the systems or system components when the individuals return from travel.

Assessment Methods

Examine

• Configuration management policy
• configuration management plan
• procedures addressing the baseline configuration of the system
• procedures addressing system component installations and upgrades
• system architecture and configuration documentation
• system configuration settings and associated documentation
• system component inventory
• records of system baseline configuration reviews and updates
• system component installations/upgrades and associated records
• change control records
• system security plan
• other relevant documents or records

Interview

• Organizational personnel with configuration management responsibilities
• organizational personnel with information security responsibilities
• system/network administrators

Test

• Organizational processes for managing baseline configurations

Powiązane zgłoszenia

• NIST -

  https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final