Title

The organization must ensure all wireless systems connected to a DoD network (including associated peripheral devices, operating system, applications, network/PC connection methods, and services) are approved by the approval authority prior to installation and use for processing DoD information. (Cat I impact)

Discussion

Unauthorized wireless systems expose DoD networks to attack. The DAA and appropriate commanders must be aware of all wireless systems used at the site. DAAs should ensure a risk assessment is conducted for each system, including associated services and peripherals, before approving. The DAA should accept risks only when required to meet mission requirements. The intent of this requirement is to ensure the DAA has approved the use of the wireless system. This approval can be documented in several ways. The most common is the site security plan includes the wireless system and the DAA has signed the site security plan. If the command uses an enterprise wide site security plan including the wireless system being reviewed, and the site security plan applies to the site being reviewed, then the requirement has been met.

Check Content

Review the organization's documentation of the wireless system connected to a DoD network to verify DAA approval either by: a.) The accreditation documentation, which must show the wireless system as part of the network diagram or list the system/equipment as being part of the network. b.) DAA approval letter or other document, which must list the system or equipment and date its use is approved. The DAA approval letter or site security plan may be a general statement of approval rather than list each device; however, it does not need to be documented separately from other DAA approval documents for the site network, as long as the approval documents list the wireless system. Verify DAA approval for the type of device used, such as wireless connection services, peripherals, and applications. If wireless systems (including associated peripheral devices, operating system, applications, network/PC connection methods and services) exist and are not approved by the approval authority prior to installation and use for processing DoD information, this is a finding.

Fix Text

Obtain DAA approval, documented by memo or site security plan, prior to wireless systems connected to a DoD network being installed or utilized.

Additional Identifiers

Rule ID:

Vulnerability ID: V-35935

Group Title:

Expert Comments

CCIs tied to check.

Controls tied to check. These are derived from the CCIs shown above.