SI-4 (10)
SI-4 (10): Visibility Of Encrypted Communications
The organization makes provisions so that [Assignment: organization-defined encrypted communications traffic] is visible to [Assignment: organization-defined information system monitoring tools].
Supplemental
Organizations balance the potentially conflicting needs for encrypting communications traffic and for having insight into such traffic from a monitoring perspective. For some organizations, the need to ensure the confidentiality of communications traffic is paramount; for others, mission-assurance is of greater concern. Organizations determine whether the visibility requirement applies to internal encrypted traffic, encrypted traffic intended for external destinations, or a subset of the traffic types.
| CIA Levels | |
|---|---|
| Confidentiality | moderate |
| Integrity | moderate |
| Availability | moderate |
| Overlays |
|---|
| None |