Title

Command and Control (C2) and non-C2 exceptions of SIPRNet must be documented in the enclaves accreditation package and an Authority to Connect (ATC) or Interim ATC amending the connection approval received prior to implementation. (Cat II impact)

Discussion

Any exception to use SIPRNet must be documented in an update to the enclave's accreditation package and an Authority to Connect (ATC) or Interim ATC amending the connection approval received prior to implementation.

Check Content

Review SIPRNet accreditation package and an Interim Authority to Connect/Authority to Connect (IATC/ATC) amending the connection approval received. If C2 and non-C2 exceptions are not documented, this is a finding.

Fix Text

Document all SIPRNet connections.

Additional Identifiers

Rule ID: SV-251381r806098_rule

Vulnerability ID: V-251381

Group Title: NET1827

Expert Comments

CCIs tied to check.

Controls tied to check. These are derived from the CCIs shown above.