NIST SP 800-53A

________________________________________________________________________________________________

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: Access control policy; procedures addressing wireless implementation and usage (including restrictions); activities related to wireless monitoring, authorization, and enforcement; information system audit records; other relevant documents or records].

Interview: [SELECT FROM: Organizational personnel responsible for authorizing, monitoring or controlling the use of wireless technologies in the information system].

Test: [SELECT FROM: Wireless access usage and restrictions].

AC-18(1) WIRELESS ACCESS

AC-18(1).1 ASSESSMENT OBJECTIVE:

Determine if the information system protects wireless access to the system using authentication and encryption.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: Access control policy; procedures addressing wireless implementation and usage (including restrictions); information system design documentation; information system configuration settings and associated documentation; information system audit records; other relevant documents or records].

Test: [SELECT FROM: Automated mechanisms implementing the access control policy for wireless access to the information system].

________________________________________________________________________________________________

AC-18(2) WIRELESS ACCESS

AC-18(2).1 ASSESSMENT OBJECTIVE:

Determine if:

(i)the organization defines the frequency of monitoring for unauthorized wireless connections to the information system, including scans for unauthorized wireless access points;

(ii)the organization monitors for unauthorized wireless connections to the information system, including scanning for unauthorized wireless access points, in accordance with organization-defined frequency;

(iii)the organization defines the appropriate action(s) to be taken if an unauthorized connection is discovered; and

(iv)the organization takes appropriate action(s) if an unauthorized connection discovered.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: Access control policy; procedures addressing wireless implementation and usage (including restrictions); wireless scanning reports; other relevant documents or records].

Interview: [SELECT FROM: Organizational personnel responsible for monitoring wireless connections to the information system].

Test: [SELECT FROM: Scanning procedures for detecting unauthorized wireless connections and access points].

AC-18(3) WIRELESS ACCESS

AC-18(3).1 ASSESSMENT OBJECTIVE:

Determine if the organization disables, when not intended for use, wireless networking capabilities internally embedded within the information system components prior to issuance and deployment.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: Access control policy; procedures addressing wireless implementation and usage (including restrictions); information system design documentation; information system configuration settings and associated documentation; information system audit records; other relevant documents or records].

Test: [SELECT FROM: Automated mechanisms controlling the disabling of wireless networking capabilities internally embedded within the information system components].

AC-18(4) WIRELESS ACCESS

AC-18(4).1 ASSESSMENT OBJECTIVE:

Determine if the organization does not allow users to independently configure wireless networking capabilities.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: Access control policy; procedures addressing wireless implementation and usage (including restrictions); information system design documentation; information system configuration settings and associated documentation; information system audit records; other relevant documents or records].

Test: [SELECT FROM: Automated mechanisms preventing independent configuration of wireless networking capabilities].

________________________________________________________________________________________________

AC-18(5) WIRELESS ACCESS

AC-18(5).1 ASSESSMENT OBJECTIVE:

Determine if the organization confines wireless communications to organizationcontrolled boundaries.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: Access control policy; procedures addressing wireless implementation and usage (including restrictions); information system design documentation; information system configuration settings and associated documentation; information system audit records; other relevant documents or records].

Test: [SELECT FROM: Automated mechanisms implementing the access control policy for wireless access to the information system; Wireless connections and access points outside of organizational boundaries using scanning devices.].

________________________________________________________________________________________________

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: Access control policy; procedures addressing access control for portable and mobile devices; information system design documentation; information system configuration settings and associated documentation; information system audit records; other relevant documents or records].

Interview: [SELECT FROM: Organizational personnel who use portable and mobile devices to access the information system].

Test: [SELECT FROM: Automated mechanisms implementing access control policy for portable and mobile devices].

________________________________________________________________________________________________

AC-19(1) ACCESS CONTROL FOR MOBILE DEVICES

AC-19(1).1 ASSESSMENT OBJECTIVE:

Determine if the organization restricts the use of writable, removable media in organizational information systems.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: Access control policy; procedures addressing access control for portable and mobile devices; information system design documentation; information system configuration settings and associated documentation; information system audit records; other relevant documents or records].

Interview: [SELECT FROM: Organizational personnel who use portable and mobile devices to access the information system].

Test: [SELECT FROM: Automated mechanisms implementing access control policy for portable and mobile devices].

AC-19(2) ACCESS CONTROL FOR MOBILE DEVICES

AC-19(2).1 ASSESSMENT OBJECTIVE:

Determine if the organization prohibits the use of personally owned, removable media in organizational information systems.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: Access control policy; procedures addressing access control for portable and mobile devices; information system design documentation; information system configuration settings and associated documentation; information system audit records; other relevant documents or records].

Test: [SELECT FROM: Automated mechanisms implementing access control policy for portable and mobile devices].

AC-19(3) ACCESS CONTROL FOR MOBILE DEVICES

AC-19(3).1 ASSESSMENT OBJECTIVE:

Determine if the organization prohibits the use of removable media in organizational information systems when the media has no identifiable owner.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: Access control policy; procedures addressing access control for portable and mobile devices; information system design documentation; information system configuration settings and associated documentation; information system audit records; other relevant documents or records].

Test: [SELECT FROM: Automated mechanisms implementing access control policy for portable and mobile devices].

________________________________________________________________________________________________

AC-19(4) ACCESS CONTROL FOR MOBILE DEVICES

AC-19(4).1 ASSESSMENT OBJECTIVE:

Determine if:

(i)the organization prohibits the use of unclassified mobile devices in facilities containing information systems processing, storing, or transmitting classified information unless specifically permitted by the appropriate authorizing official(s);

(ii)the organization defines the security officials authorized to randomly review/inspect mobile devices and the information stored on those devices for classified information; and

(iii)the organization enforces the following restrictions on individuals permitted to use mobile devices in facilities containing information systems processing, storing, or transmitting classified information:

-connection of unclassified mobile devices to classified information systems is prohibited;

-connection of unclassified mobile devices to unclassified information systems requires approval from the appropriate authorizing official(s);

-use of internal or external modems or wireless interfaces within the mobile devices is prohibited; and

-mobile devices and the information stored on those devices are subject to random reviews/inspections by organization-defined security officials, and if classified information is found, the incident handling policy is enforced.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: Access control policy; procedures addressing access control for portable and mobile devices; evidentiary documentation for random inspections of mobile devices; information system audit records; other relevant documents or records].

Interview: [SELECT FROM: Organizational personnel responsible for randomly reviewing/inspecting mobile devices; Organizational personnel using mobile devices in facilities containing information systems processing, storing, or transmitting classified information].

Test: [SELECT FROM: Test automated mechanisms prohibiting the use of internal or external modems or wireless interfaces with mobile devices].

________________________________________________________________________________________________

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: Access control policy; procedures addressing the use of external information systems; external information systems terms and conditions; list of types of applications accessible from external information systems; maximum security categorization for information processed, stored, or transmitted on external information systems; information system configuration settings and associated documentation; other relevant documents or records].

Interview: [SELECT FROM: Organizational personnel with responsibilities for defining terms and conditions for use of external information systems to access organizational systems].

AC-20(1) USE OF EXTERNAL INFORMATION SYSTEMS

AC-20(1).1 ASSESSMENT OBJECTIVE:

Determine if the organization permits authorized individuals to use an external information system to access the information system or to process, store, or transmit organization-controlled information only when the organization:

-can verify the implementation of required security controls on the external system as specified in the organization’s information security policy and security plan; or

-has approved information system connection or processing agreements with the organizational entity hosting the external information system.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: Access control policy; procedures addressing the use of external information systems; security plan; information system connection or processing agreements; account management documents; other relevant documents or records].

________________________________________________________________________________________________

AC-20(2) USE OF EXTERNAL INFORMATION SYSTEMS

AC-20(2).1 ASSESSMENT OBJECTIVE:

Determine if the organization limits the use of organization-controlled portable storage media by authorized individuals on external information systems.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: Access control policy; procedures addressing the use of external information systems; security plan; information system configuration settings and associated documentation; information system connection or processing agreements; account management documents; other relevant documents or records].

________________________________________________________________________________________________

Determine if:

(i)the organization defines the circumstances where user discretion is required to facilitate information sharing;

(ii)the organization facilitates information sharing by enabling authorized users to determine whether access authorizations assigned to the sharing partner match the access restrictions on the information for the organization-defined circumstances;

(iii)the organization defines the information sharing circumstances and automated mechanisms or manual processes required to assist users in making information sharing/collaboration decisions; and

(iv)the organization employs organization-defined circumstances and automated mechanisms or manual processes to assist users in making information sharing/collaboration decisions.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: Access control policy; procedures addressing user-based collaboration and information sharing (including restrictions); information system design documentation; information system configuration settings and associated documentation; list of users authorized to make information sharing/collaboration decisions; list of information sharing circumstances requiring user discretion; other relevant documents or records].

Interview: [SELECT FROM: Organizational personnel responsible for making information sharing/collaboration decisions].

Test: [SELECT FROM: Automated mechanisms or manual process implementing access authorizations supporting information sharing/user collaboration decisions].

AC-21(1) USER-BASED COLLABORATION AND INFORMATION SHARING

AC-21(1).1 ASSESSMENT OBJECTIVE:

Determine if the information system employs automated mechanisms to enable authorized users to make information-sharing decisions based on access authorizations of sharing partners and access restrictions on information to be shared.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: Access control policy; procedures addressing user-based collaboration and information sharing (including restrictions); information system design documentation; information system configuration settings and associated documentation; system-generated list of users authorized to make information sharing/collaboration decisions; systemgenerated list of sharing partners and access authorizations; system-generated list of access restrictions regarding information to be shared; other relevant documents or records].

Test: [SELECT FROM: Automated mechanisms implementing access authorizations supporting information sharing/user collaboration decisions].

________________________________________________________________________________________________

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: Access control policy; procedures addressing publicly accessible content; list of users authorized to post publicly accessible content on organizational information systems; training materials and/or records; records of publicly accessible information reviews; records of response to nonpublic information on public Web sites; system audit logs; security awareness training records; other relevant documents or records].

Interview: [SELECT FROM: Organizational personnel responsible for managing publicly accessible information posted on organizational information systems].