Applicable

(Y)es / (N)o

(C)onfidentiality

(I)ntegrity

(A)vailability

RPN

(C+I+A)

(S)atisfactory

L1

M2

H3

L1

M2

H3

L1

M2

H3

(O)ther than satisfactory +##

ca-3(5)

system interconnections | restrictions on external system connections

assessment objective:

Determine if the organization: 

ca-3(5)[1]

defines information systems to be allowed to connect to external information systems;

ca-3(5)[2]

employs one of the following policies for allowing organization-defined information systems to connect to external information systems:

ca-3(5)[2][a]

allow-all policy;

ca-3(5)[2][b]

deny-by-exception policy;

ca-3(5)[2][c]

deny-all policy; or

ca-3(5)[2][d]

permit-by-exception policy.

potential assessment methods and objects:

Examine: [SELECT FROM: Access control policy; procedures addressing information system connections; system and communications protection policy; information system interconnection agreements; security plan; information system design documentation; information system configuration settings and associated documentation; security assessment report; information system audit records; other relevant documents or records].

Interview: [select from: Organizational personnel with responsibility for managing connections to external information systems; network administrators; organizational personnel with information security responsibilities].

Test: [select from: Automated mechanisms implementing restrictions on external system connections].