Assessment Objective

Determine if:

• SC-07a.
  • SC-07a.[01] communications at external managed interfaces to the system are monitored;
  • SC-07a.[02] communications at external managed interfaces to the system are controlled;
  • SC-07a.[03] communications at key internal managed interfaces within the system are monitored;
  • SC-07a.[04] communications at key internal managed interfaces within the system are controlled;
• SC-07b. subnetworks for publicly accessible system components are [Selection: physically; logically] separated from internal organizational networks;
• SC-07c. external networks or systems are only connected to through managed interfaces consisting of boundary protection devices arranged in accordance with an organizational security and privacy architecture.

Assessment Methods

Examine

• System and communications protection policy
• procedures addressing boundary protection
• list of key internal boundaries of the system
• system design documentation
• boundary protection hardware and software
• system configuration settings and associated documentation
• enterprise security architecture documentation
• system audit records
• system security plan
• other relevant documents or records

Interview

• System/network administrators
• organizational personnel with information security responsibilities
• system developer
• organizational personnel with boundary protection responsibilities

Test

• Mechanisms implementing boundary protection capabilities

Pedidos ligados

• NIST -

  https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final