Assessment Objective
Determine if:
- AC-21(02) information search and retrieval services that enforce [Assignment: information-sharing restrictions] are implemented.
Assessment Methods
Examine
- Access control policy
- procedures addressing user-based collaboration and information sharing (including restrictions)
- system design documentation
- system configuration settings and associated documentation
- system-generated list of access restrictions regarding information to be shared
- information search and retrieval records
- system audit records
- system security plan
- other relevant documents or records
Interview
- Organizational personnel with access enforcement responsibilities for system search and retrieval services
- system/network administrators
- organizational personnel with information security responsibilities
- system developers
Test
- System search and retrieval services enforcing information-sharing restrictions
Powiązane zgłoszenia
| Typ powiązania | Zgłoszenie |
|---|---|
| blocks | AC-21(02) Information Search and Retrieval |