Title

There must be user agreements documenting the use of A/B switches. (Cat III impact)

Discussion

A signed user agreement is proof that the user has been informed of his security responsibilities when using an A/B switch. The ISSO will maintain written user agreements for all users authorized to use an A/B switch.

Check Content

The reviewer will interview the ISSO and view the user agreements. A singed addendum to the SAAR is acceptable. If signed A/B switch user agreements are not on file, this is a finding.

Fix Text

Create a standard user agreement for the use of A/B switches and have all authorized A/B switches users sign a user agreement.

Additional Identifiers

Rule ID: SV-6921r2_rule

Vulnerability ID: V-6718

Group Title:

Expert Comments

CCIs tied to check.

Controls tied to check. These are derived from the CCIs shown above.