id: "AC-19(04)" title: "Restrictions for Classified Information" family: "AC" family_name: "Access Control" sort_id: "ac-19.04" priority: "P1" implementation_level: "organization" parent: "AC-19" enhancement: True
Prohibit the use of unclassified mobile devices in facilities containing systems processing, storing, or transmitting classified information unless specifically permitted by the authorizing official; and
Enforce the following restrictions on individuals permitted by the authorizing official to use unclassified mobile devices in facilities containing systems processing, storing, or transmitting classified information:
Connection of unclassified mobile devices to classified systems is prohibited;
Connection of unclassified mobile devices to unclassified systems requires approval from the authorizing official;
Use of internal or external modems or wireless interfaces within the unclassified mobile devices is prohibited; and
Unclassified mobile devices and the information stored on those devices are subject to random reviews and inspections by {{ insert: param, ac-19.04_odp.01 }} , and if classified information is found, the incident handling policy is followed.
Restrict the connection of classified mobile devices to classified systems in accordance with {{ insert: param, ac-19.04_odp.02 }}.
Guidance
None.
Assessment Objective: the use of unclassified mobile devices in facilities containing systems processing, storing, or transmitting classified information is prohibited unless specifically permitted by the authorizing official;
Assessment Objective: prohibition of the connection of unclassified mobile devices to classified systems is enforced on individuals permitted by an authorizing official to use unclassified mobile devices in facilities containing systems processing, storing, or transmitting classified information;
Assessment Objective: approval by the authorizing official for the connection of unclassified mobile devices to unclassified systems is enforced on individuals permitted to use unclassified mobile devices in facilities containing systems processing, storing, or transmitting classified information;
Assessment Objective: prohibition of the use of internal or external modems or wireless interfaces within unclassified mobile devices is enforced on individuals permitted by an authorizing official to use unclassified mobile devices in facilities containing systems processing, storing, or transmitting classified information;
Assessment Objective: random review and inspection of unclassified mobile devices and the information stored on those devices by {{ insert: param, ac-19.04_odp.01 }} are enforced;
Assessment Objective: following of the incident handling policy is enforced if classified information is found during a random review and inspection of unclassified mobile devices;
Assessment Objective: the connection of classified mobile devices to classified systems is restricted in accordance with {{ insert: param, ac-19.04_odp.02 }}.
Access control policy
incident handling policy
procedures addressing access control for mobile devices
system design documentation
system configuration settings and associated documentation
evidentiary documentation for random inspections and reviews of mobile devices
system audit records
system security plan
other relevant documents or records
Organizational personnel responsible for random reviews/inspections of mobile devices
organizational personnel using mobile devices in facilities containing systems processing, storing, or transmitting classified information
organizational personnel with incident response responsibilities
system/network administrators
organizational personnel with information security responsibilities
Mechanisms prohibiting the use of internal or external modems or wireless interfaces with mobile devices