CA-9(1)

Requirement

Perform security and privacy compliance checks on constituent system components prior to the establishment of the internal connection.

Discussion

Compliance checks include verification of the relevant baseline configuration.

NIST 800-53A Assessment Guidance

Examine

[SELECT FROM: Assessment, authorization, and monitoring policy; access control policy; procedures addressing system connections; system and communications protection policy; system design documentation; system configuration settings and associated documentation; list of components or classes of components authorized as internal system connections; assessment report; system audit records; system security plan; privacy plan; other relevant documents or records].

Interview

[SELECT FROM: Organizational personnel with responsibilities for developing, implementing, or authorizing internal system connections; organizational personnel with information security and privacy responsibilities].

ID	Assessment Objectives
CA-09(01)[01]	security compliance checks are performed on constituent system components prior to the establishment of the internal connection;
CA-09(01)[02]	privacy compliance checks are performed on constituent system components prior to the establishment of the internal connection.

Our CMMC Overview Course simplifies CMMC. Enroll so you can make informed decisions!