Assessment Objectives
In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that:
- NET-04_A01 information flow control policies are defined.
Assessment rigor: 1
Origin: 171A_3.1.3[a] 53A_R5_AC-04_ODP - NET-04_A02 methods and enforcement mechanisms for controlling the flow of sensitive / regulated data are defined.
Assessment rigor: 1
Origin: 171A_3.1.3[b] - NET-04_A03 approved authorizations are enforced for controlling the flow of information within the system and between connected systems based on organization-defined information flow control policies.
Assessment rigor: 1
Origin: 53A_R5_AC-04 - NET-04_A04 designated sources and destinations (e.g., networks, individuals and devices) for sensitive / regulated data within the system and between interconnected systems are identified.
Assessment rigor: 2
Origin: 171A_3.1.3[c] - NET-04_A05 authorizations for controlling the flow of sensitive / regulated data are defined.
Assessment rigor: 2
Origin: 171A_3.1.3[d] - NET-04_A06 approved authorizations are enforced for controlling the flow of CUI between connected systems.
Assessment rigor: NIST 800-171
Origin: 171A_3.1.3[e] 171A_R3_A.03.01.03[02] - NET-04_A07 secure information transfer solutions are defined.
Assessment rigor: 3
Origin: 172A_3.1.3e_ODP[1] - NET-04_A08 information flows between security domains on connected systems are identified.
Assessment rigor: 3
Origin: 172A_3.1.3e[a] - NET-04_A09 solutions are employed to control information flows between security domains on connected systems.
Assessment rigor: 3
Origin: 172A_3.1.3e[b] - NET-04_A10 systems and system components included in the scope of the specified enhanced security requirements are identified.
Assessment rigor: 3
Origin: 172A_3.14.3e_ODP[1] - NET-04_A11 systems and system components are included in the scope of the specified enhanced security requirements.
Assessment rigor: 3
Origin: 172A_3.14.3e[a] - NET-04_A12 systems and system components that are not included in systems and system components are segregated in purpose-specific networks.
Assessment rigor: 3
Origin: 172A_3.14.3e[b]
Povezane zadeve
| Vrsta povezave | Zadeva |
|---|---|
| blocks | Data Flow Enforcement – Access Control Lists (ACLs) |
- Secure Controls Framework -
EN: GRCA includes the Secure Controls Framework® (SCF) content, © Secure Controls Framework Council, LLC, used under the Creative Commons Attribution-NoDerivatives 4.0 International Public License. SCF control numbers, names, descriptions and mappings appear exactly as published by the SCF Council – https://securecontrolsframework.com. GRCA may group or reorder SCF content for display, which does not change SCF content; the mappings are shown as links to the frameworks they name. Learn more at https://securecontrolsframework.com.
DE: GRCA enthält Inhalte des Secure Controls Framework® (SCF), © Secure Controls Framework Council, LLC, genutzt unter der Creative Commons Attribution-NoDerivatives 4.0 International Public License. Nummern, Namen, Beschreibungen und Zuordnungen der SCF-Controls erscheinen genau so, wie der SCF Council sie veröffentlicht – https://securecontrolsframework.com. GRCA gruppiert oder sortiert SCF-Inhalte für die Anzeige, ohne sie zu verändern; die Zuordnungen erscheinen als Verknüpfungen zu den genannten Regelwerken. Mehr unter https://securecontrolsframework.com.