Title

The organization must have written policy or training material stating CMDs must not be used to receive, transmit, or process classified messages unless specifically approved by NSA for such purposes and NSA-approved transmission and storage methods are used. (Cat I impact)

Discussion

Wireless devices will not be used for processing classified data unless approved for such use as classified data could be compromised or exposed to unauthorized personnel.

Check Content

Verify written policy and training material exists (or requirement is listed on a signed user agreement) stating CMDs must not be used to transmit classified information. If written policy or training material, stating CMDs must not be used to receive, transmit, or process classified information, does not exist, this is a finding.

Fix Text

Develop and publish policy preventing CMDs from processing, sending, receiving, or storing classified data.

Additional Identifiers

Rule ID:

Vulnerability ID: V-35955

Group Title:

Expert Comments

CCIs tied to check.

Controls tied to check. These are derived from the CCIs shown above.