Assessment Objective
Determine if:
- AC-20(04) the use of [Assignment: network-accessible storage devices] is prohibited in external systems.
Assessment Methods
Examine
- Access control policy
- procedures addressing use of network-accessible storage devices in external systems
- system design documentation
- system configuration settings and associated documentation
- system connection or processing agreements
- list of network-accessible storage devices prohibited from use in external systems
- system audit records
- system security plan
- other relevant documents or records
Interview
- Organizational personnel with responsibilities for prohibiting the use of network-accessible storage devices in external systems
- system/network administrators
- organizational personnel with information security responsibilities
Test
- Mechanisms prohibiting the use of network-accessible storage devices in external systems
Tichete legate
| Tip de legătură | Tichet |
|---|---|
| blocks | AC-20(04) Network Accessible Storage Devices — Prohibited Use |