Applicable

(Y)es / (N)o

(C)onfidentiality

(I)ntegrity

(A)vailability

RPN

(C+I+A)

(S)atisfactory

L1

M2

H3

L1

M2

H3

L1

M2

H3

(O)ther than satisfactory +##

cm-8(3)

information system component inventory  | automated unauthorized component detection  

assessment objective:

Determine if the organization:

cm-8(3)(a)

cm-8(3)(a)[1]

defines the frequency to employ automated mechanisms to detect the presence of unauthorized:

cm-8(3)(a)[1][a]

hardware components within the information system;

cm-8(3)(a)[1][b]

software components within the information system;

cm-8(3)(a)[1][c]

firmware components within the information system;

cm-8(3)(a)[2]

employs automated mechanisms with the organization-defined frequency to detect the presence of unauthorized:

cm-8(3)(a)[2][a]

hardware components within the information system;

cm-8(3)(a)[2][b]

software components within the information system;

cm-8(3)(a)[2][c]

firmware components within the information system;

cm-8(3)(b)

cm-8(3)(b)[1]

defines personnel or roles to be notified when unauthorized components are detected;

cm-8(3)(b)[2]

takes one or more of the following actions when unauthorized components are detected:

cm-8(3)(b)[2][a]

disables network access by such components;

cm-8(3)(b)[2][b]

isolates the components; and/or

cm-8(3)(b)[2][c]

notifies organization-defined personnel or roles.

potential assessment methods and objects:

Examine: [select from: Configuration management policy;  procedures addressing information system component inventory; configuration management plan; security plan; information system design documentation; information system configuration settings and associated documentation; information system inventory records; alerts/notifications of unauthorized components within the information system; information system monitoring records; change control records; information system audit records; other relevant documents or records].

Interview: [select from: Organizational personnel with responsibilities for managing the automated mechanisms implementing unauthorized information system component detection; organizational personnel with information security responsibilities; system/network administrators; system developers].

Test: [select from: Organizational processes for detection of unauthorized information system components; automated mechanisms implementing the detection of unauthorized information system components].