Applicable

(Y)es / (N)o

(C)onfidentiality

(I)ntegrity

(A)vailability

RPN

(C+I+A)

(S)atisfactory

L1

M2

H3

L1

M2

H3

L1

M2

H3

(O)ther than satisfactory +##

ac-4(21)

information flow enforcement  | physical / logical separation of information flows

assessment objective:

Determine if:

ac-4(21)[1]

the organization defines the required separations of information flows by types of information;

ac-4(21)[2]

the organization defines the mechanisms and/or techniques to be used to separate information flows logically or physically; and

ac-4(21)[3]

the information system separates information flows logically or physically using organization-defined mechanisms and/or techniques to accomplish organization-defined required separations by types of information.

potential assessment methods and objects:

Examine: [select from: Information flow enforcement policy; information flow control policies; procedures addressing information flow enforcement; information system design documentation; information system configuration settings and associated documentation; list of required separation of information flows by information types; list of mechanisms and/or techniques used to logically or physically separate information flows; information system audit records; other relevant documents or records].

Interview: [select from: Organizational personnel with information flow enforcement responsibilities; system/network administrators; organizational personnel with information security responsibilities; system developers].

Test: [select from: Automated mechanisms implementing information flow enforcement functions].