Title

Direct Inward System Access and Voice Mail access codes are not changed semi-annually. (Cat III impact)

Discussion

Requirement: The IAO will ensure that if Voice Mail services are controlled by special authorization code, this code will be controlled and changed semi-annually. The special access code used by all subscribers to control access to the Direct Inward System Access and Voice Mail features should be controlled much like a password. If this special access code is not changed periodically, the service is more likely to be compromised, thus degrading system access security.

Check Content

Interview the IAO or SA and confirm compliance through discussion, review of site policy, diagrams, documentation, DAA approvals, etc as applicable.

Fix Text

Implement processes / procedures, generate documents, and/or adjust configuration(s) / architecture, as necessary to comply with policy.

Additional Identifiers

Rule ID: SV-8428r1_rule

Vulnerability ID: V-7942

Group Title: DISA access codes are not changed semi-annually

Expert Comments

CCIs tied to check.

Controls tied to check. These are derived from the CCIs shown above.