IA-3(3)

Requirement
1. Where addresses are allocated dynamically, standardize dynamic address allocation lease information and the lease duration assigned to devices in accordance with [Assignment: organization-defined lease information and lease duration]; and
2. Audit lease information when assigned to a device.

Discussion

The Dynamic Host Configuration Protocol (DHCP) is an example of a means by which clients can dynamically receive network address assignments.

NIST 800-53A Assessment Guidance

Examine

[SELECT FROM: Identification and authentication policy; system security plan; procedures addressing device identification and authentication; system design documentation; system configuration settings and associated documentation; evidence of lease information and lease duration assigned to devices; device connection reports; system audit records; other relevant documents or records].

Interview

[SELECT FROM: Organizational personnel with operational responsibilities for device identification and authentication; organizational personnel with information security responsibilities; system/network administrators; system developers].

Test

[SELECT FROM: Mechanisms supporting and/or implementing device identification and authentication capabilities; mechanisms supporting and/or implementing dynamic address allocation; mechanisms supporting and/or implanting auditing of lease information].

ID	Assessment Objectives
IA-03(03)(b)	lease information is audited when assigned to a device.
IA-03(03)(a)[02]	dynamic address allocation lease duration assigned to devices where addresses are allocated dynamically are standardized in accordance with <IA-03(03)_ODP[02] lease duration>;
IA-03(03)(a)[01]	dynamic address allocation lease information assigned to devices where addresses are allocated dynamically are standardized in accordance with <IA-03(03)_ODP[01] lease information>;

Our CMMC Overview Course simplifies CMMC. Enroll so you can make informed decisions!