Applicable

(Y)es / (N)o

(C)onfidentiality

(I)ntegrity

(A)vailability

RPN

(C+I+A)

(S)atisfactory

L1

M2

H3

L1

M2

H3

L1

M2

H3

(O)ther than satisfactory +##

ia-3(3)

device identification and authentication  | dynamic address allocation

assessment objective:

Determine if the organization:

ia-3(3)(a)

ia-3(3)(a)[1]

defines lease information to be employed to standardize dynamic address allocation for devices;

ia-3(3)(a)[2]

defines lease duration to be employed to standardize dynamic address allocation for devices;

ia-3(3)(a)[3]

standardizes dynamic address allocation of lease information assigned to devices in accordance with organization-defined lease information;

ia-3(3)(a)[4]

standardizes dynamic address allocation of the lease duration assigned to devices in accordance with organization-defined lease duration; and

ia-3(3)(b)

audits lease information when assigned to a device.

potential assessment methods and objects:

Examine: [select from: Identification and authentication policy; procedures addressing device identification and authentication; information system design documentation; information system configuration settings and associated documentation; evidence of lease information and lease duration assigned to devices; device connection reports; information system audit records; other relevant documents or records].

Interview: [select from: Organizational personnel with operational responsibilities for device identification and authentication; organizational personnel with information security responsibilities; system/network administrators; system developers].

Test: [select from: Automated mechanisms supporting and/or implementing device identification and authentication capability; automated mechanisms supporting and/or implementing dynamic address allocation; automated mechanisms supporting and/or implanting auditing of lease information].