SI-14(3)

Requirement

Establish connections to the system on demand and terminate connections after [Selection: completion of a request; a period of non-use].

Discussion

Persistent connections to systems can provide advanced adversaries with paths to move laterally through systems and potentially position themselves closer to high value assets. Limiting the availability of such connections impedes the adversary's ability to move freely through organizational systems.

NIST 800-53A Assessment Guidance

Examine

[SELECT FROM: System and information integrity policy; system and information integrity procedures; procedures addressing non-persistence for system components; system design documentation; system configuration settings and associated documentation; system audit records; system security plan; other relevant documents or records].

Interview

[SELECT FROM: Organizational personnel responsible for limiting persistent connections; organizational personnel with information security responsibilities].

Test

[SELECT FROM: Organizational processes for limiting persistent connections; automated mechanisms supporting and/or implementing non-persistent connectivity].

ID	Assessment Objectives
SI-14(03)[01]	connections to the system are established on demand;
SI-14(03)[02]	connections to the system are terminated after <SI-14(03)_ODP SELECTED PARAMETER VALUE>.

Our CMMC Overview Course simplifies CMMC. Enroll so you can make informed decisions!