Assessment Objective
Determine if:
- AC-19(04)(a) the use of unclassified mobile devices in facilities containing systems processing, storing, or transmitting classified information is prohibited unless specifically permitted by the authorizing official;
- AC-19(04)(b)
- AC-19(04)(b)(01) prohibition of the connection of unclassified mobile devices to classified systems is enforced on individuals permitted by an authorizing official to use unclassified mobile devices in facilities containing systems processing, storing, or transmitting classified information;
- AC-19(04)(b)(02) approval by the authorizing official for the connection of unclassified mobile devices to unclassified systems is enforced on individuals permitted to use unclassified mobile devices in facilities containing systems processing, storing, or transmitting classified information;
- AC-19(04)(b)(03) prohibition of the use of internal or external modems or wireless interfaces within unclassified mobile devices is enforced on individuals permitted by an authorizing official to use unclassified mobile devices in facilities containing systems processing, storing, or transmitting classified information;
- AC-19(04)(b)(04)
- AC-19(04)(b)(04)[01] random review and inspection of unclassified mobile devices and the information stored on those devices by [Assignment: security officials] are enforced;
- AC-19(04)(b)(04)[02] following of the incident handling policy is enforced if classified information is found during a random review and inspection of unclassified mobile devices;
- AC-19(04)(c) the connection of classified mobile devices to classified systems is restricted in accordance with [Assignment: security policies].
Assessment Methods
Examine
- Access control policy
- incident handling policy
- procedures addressing access control for mobile devices
- system design documentation
- system configuration settings and associated documentation
- evidentiary documentation for random inspections and reviews of mobile devices
- system audit records
- system security plan
- other relevant documents or records
Interview
- Organizational personnel responsible for random reviews/inspections of mobile devices
- organizational personnel using mobile devices in facilities containing systems processing, storing, or transmitting classified information
- organizational personnel with incident response responsibilities
- system/network administrators
- organizational personnel with information security responsibilities
Test
- Mechanisms prohibiting the use of internal or external modems or wireless interfaces with mobile devices
Powiązane zgłoszenia
| Typ powiązania | Zgłoszenie |
|---|---|
| blocks | AC-19(04) Restrictions for Classified Information |