AC.L3-3.1.2e

Implementing this requirement ensures that an organization has control over the systems that can connect to organizational assets. This control will allow more effective and efficient application of security policy.

Example

You are the chief network architect for your company. Company policy states that all company-owned assets must be separated from all non-company-owned (i.e., guest or employee) assets. You decide the best way forward is to modify the corporate wired and wireless networks to only allow company-owned devices to connect [b]. All other devices are connected to a second (untrusted) network that non-corporate devices may use to access the internet. The two environments are physically separated and are not allowed to be connected. You also decide to limit the virtual private network (VPN) services of the company to devices owned by the corporation by installing certificate keys and have the VPN validate the configuration of connecting devices before they are allowed in [b].

Potential Assessment Considerations

• Can the organization demonstrate a non-company-owned device failing to access information resources owned by the company [b]?
• How is this requirement met for organizational devices that are specialized assets (GFE, restricted information systems) [a,b]?
• Does the company allow employees to charge personal cell phones on organizational systems [b]?