Assessment Objective
Determine if:
- PS-06a. access agreements are developed and documented for organizational systems;
- PS-06b. the access agreements are reviewed and updated [Assignment: frequency];
- PS-06c.
- PS-06c.01 individuals requiring access to organizational information and systems sign appropriate access agreements prior to being granted access;
- PS-06c.02 individuals requiring access to organizational information and systems re-sign access agreements to maintain access to organizational systems when access agreements have been updated or [Assignment: frequency].
Assessment Methods
Examine
- Personnel security policy
- personnel security procedures
- procedures addressing access agreements for organizational information and systems
- access control policy
- access control procedures
- access agreements (including non-disclosure agreements, acceptable use agreements, rules of behavior, and conflict-of-interest agreements)
- documentation of access agreement reviews, updates, and re-signing
- system security plan
- privacy plan
- other relevant documents or records
Interview
- Organizational personnel with personnel security responsibilities
- organizational personnel who have signed/resigned access agreements
- organizational personnel with information security and privacy responsibilities
Test
- Organizational processes for reviewing, updating, and re-signing access agreements
- mechanisms supporting the reviewing, updating, and re-signing of access agreements
Länkade ärenden
| Länktyp | Ärende |
|---|---|
| blocks | PS-06 [L] Access Agreements |