Title

OOB management network are NOT dedicated to management of like or associated systems (Cat II impact)

Discussion

Requirement: The IAO will ensure that network connected switch and device management ports are connected to a network dedicated to management of the device only and/or that of other associated devices, i.e. an out-of-band management network. Management networks must be dedicated to management to mitigate unauthorized access to the managed systems of the sensitive management information/traffic that is carried on the network

Check Content

Interview the IAO and/or SA to confirm compliance through discussion, review of site policy and procedures, diagrams, documentation, configuration files, logs, records, DAA/other approvals, etc as applicable

Fix Text

> Implement processes / procedures, generate documents, and/or adjust configuration(s) / architecture, as necessary to comply with policy.

Additional Identifiers

Rule ID: SV-9012r1_rule

Vulnerability ID: V-8517

Group Title: OOB management network are NOT dedicated

Expert Comments

CCIs tied to check.

Controls tied to check. These are derived from the CCIs shown above.