Applicable (Y)es / (N)o |
(C)onfidentiality |
(I)ntegrity |
(A)vailability |
RPN (C+I+A) |
(S)atisfactory |
||||||
L1 |
M2 |
H3 |
L1 |
M2 |
H3 |
L1 |
M2 |
H3 |
(O)ther than satisfactory +## |
||
|
|
|
|
|
|
|
|
|
|
|
|
###
sc-43 |
usage restrictions |
|||
|
assessment objective: Determine if the organization: |
|||
sc-43(a) |
sc-43(a)[1] |
defines information system components for which usage restrictions and implementation guidance are to be established; |
||
sc-43(a)[2] |
establishes, for organization-defined information system components: |
|||
sc-43(a)[2][a] |
usage restrictions based on the potential to cause damage to the information system if used maliciously; |
|||
sc-43(a)[2][b] |
implementation guidance based on the potential to cause damage to the information system if used maliciously; |
|||
sc-43(b) |
sc-43(b)[1] |
authorizes the use of such components within the information system; |
||
sc-43(b)[2] |
monitors the use of such components within the information system; and |
|||
sc-43(b)[3] |
controls the use of such components within the information system. |
|||
potential assessment methods and objects: Examine: [select from: System and communications protection policy; procedures addressing usage restrictions; usage restrictions; implementation policy and procedures; authorization records; information system monitoring records; information system audit records; other relevant documents or records]. Interview: [select from: System/network administrators; organizational personnel with information security responsibilities; organizational personnel installing, configuring, and/or maintaining the information system]. Test: [select from: Organizational processes for authorizing, monitoring, and controlling use of components with usage restrictions; Automated mechanisms supporting and/or implementing authorizing, monitoring, and controlling use of components with usage restrictions]. |