Navigate

CA-9

CA-9: Internal System Connections

a: Authorize internal connections of [system components or classes of components requiring internal connections to the system are defined;] to the system;

b: Document, for each internal connection, the interface characteristics, security and privacy requirements, and the nature of the information communicated;

c: Terminate internal system connections after [conditions requiring termination of internal connections are defined;] ; and

d: Review [frequency at which to review the continued need for each internal connection is defined;] the continued need for each internal connection.

Supplemental

Internal system connections are connections between organizational systems and separate constituent system components (i.e., connections between components that are part of the same system) including components used for system development. Intra-system connections include connections with mobile devices, notebook and desktop computers, tablets, printers, copiers, facsimile machines, scanners, sensors, and servers. Instead of authorizing each internal system connection individually, organizations can authorize internal connections for a class of system components with common characteristics and/or configurations, including printers, scanners, and copiers with a specified processing, transmission, and storage capability or smart phones and tablets with a specific baseline configuration. The continued need for an internal system connection is reviewed from the perspective of whether it provides support for organizational missions or business functions.

CIA Levels
Confidentiality	low
Integrity	low
Availability	unknown

Overlays
DAF Baseline, Privacy (accountability), Privacy (high), Privacy (low), Privacy (moderate)

CSF Categories
ID.AM-3

Related Controls

The controls below (if any) were marked by NIST as being related to CA-9.

Control	Description
AC-3	Enforce approved authorizations for logical access to information and system resources in accordance with applicable access control policies.
AC-4	Enforce approved authorizations for controlling the flow of information within the system and between connected systems based on [information flow control policies within the system and between connected systems are defined;].
AC-18	a: Establish configuration requirements, connection requirements, and implementation guidance for each type of wireless access; and b: Authorize each type of wireless access to the system prior to allowing such connections.
AC-19	a: Establish configuration requirements, connection requirements, and implementation guidance for organization-controlled mobile devices, to include when such devices are outside of controlled areas; and b: Authorize the connection of mobile devices to organizational systems.
CM-2	a: Develop, document, and maintain under configuration control, a current baseline configuration of the system; and b: Review and update the baseline configuration of the system: 1: [the frequency of baseline configuration review and update is defined;]; 2: When required due to [the circumstances requiring baseline configuration review and update are defined;] ; and 3: When system components are installed or upgraded.
IA-3	Uniquely identify and authenticate [devices and/or types of devices to be uniquely identified and authenticated before establishing a connection are defined;] before establishing a [one or more of "local"/"remote"/"network"] connection.
SC-7	a: Monitor and control communications at the external managed interfaces to the system and at key internal managed interfaces within the system; b: Implement subnetworks for publicly accessible system components that are [one of "physically"/"logically"] separated from internal organizational networks; and c: Connect to external networks or systems only through managed interfaces consisting of boundary protection devices arranged in accordance with an organizational security and privacy architecture.
SI-12	Manage and retain information within the system and information output from the system in accordance with applicable laws, executive orders, directives, regulations, policies, standards, guidelines and operational requirements.

Enhancements

The controls below (if any) add on to the requirements of CA-9.

Control	Description
CA-9(1)	Perform security and privacy compliance checks on constituent system components prior to the establishment of the internal connection.

Related CCIs

The CCIs below are tied to CA-9.

CCI	Definition
CCI-002101	Authorizes internal connections of organization-defined system components or classes of components to the system.
CCI-002102	Defines the system components or classes of components that are authorized internal connections to the system.
CCI-002103	Document, for each internal connection, the interface characteristics.
CCI-002104	Document, for each internal connection, the security requirements.
CCI-002105	Document, for each internal connection, the nature of the information communicated.
CCI-003891	Document, for each internal connection, the privacy requirements.
CCI-003892	Terminate internal system connections after organization-defined conditions.
CCI-003893	Defines the conditions for terminating internal system connections.
CCI-003894	Review on an organization-defined frequency the continued need for each internal connection.
CCI-003895	Defines the frequency for reviewing each internal connection.