Title

DSN voice and video systems and devices must be used with the same configuration and intended purpose as listed in the APL. (Cat III impact)

Discussion

Systems must be implemented using the configuration that was approved and for the approved purpose. Alternate configurations and purposes must be resubmitted for certification to approval authorities. DSN APL listed systems are submitted for testing in coordination with the sponsor’s needs. Systems and devices are submitted with a specific suite of equipment, software, software versions, connection types, configurations, and use cases or purposes. The resulting test results are only applicable to the specific purpose submitted. As a result, it is the specific solution and purpose that is approved and listed on the APL. If any submitted solution is changed, there may be different vulnerabilities associated with the modified solution that were not present in the originally tested solution. For this reason, modified solutions must be tested to assure that any newly acquired vulnerability is found and addressed.

Check Content

Review site documentation to confirm all DSN voice and video systems and devices are used with the same configuration and intended purpose as listed in the APL. If the voice and video systems and devices are not used with the same configuration and intended purpose as listed in the APL, this is a finding.

Fix Text

Implement DSN voice and video systems and devices with the same configuration and intended purpose as listed in the APL.

Additional Identifiers

Rule ID: SV-8842r2_rule

Vulnerability ID: V-8347

Group Title: APL listing

Expert Comments

CCIs tied to check.

Controls tied to check. These are derived from the CCIs shown above.