CCI-002103

Implementation Guidance

Determine if: - for each internal connection, the interface characteristics are documented. - for each internal connection, the security requirements are documented. - for each internal connection, the privacy requirements are documented. - for each internal connection, the nature of the information communicated is documented.

Validation Procedures

Examine: [SELECT FROM: Assessment, authorization, and monitoring policy; access control policy; procedures addressing system connections; system and communications protection policy; system design documentation; system configuration settings and associated documentation; list of components or classes of components authorized as internal system connections; assessment report; system audit records; system security plan; privacy plan; other relevant documents or records]. Interview: [SELECT FROM: Organizational personnel with responsibilities for developing, implementing, or authorizing internal system connections; organizational personnel with information security and privacy responsibilities]. Test: [SELECT FROM: Mechanisms supporting internal system connections].