STIGQter: STIG Summary: Traditional Security Checklist Version: 1 Release: 3 Benchmark Date: 15 Jun 2020:

Information Assurance - Classified Portable Electronic Devices (PEDs) Connected to the SIPRNet must be Authorized, Compliant with NSA Guidelines, and be Configured for Data at Rest (DAR) Protection

DISA Rule

SV-41269r3_rule

Vulnerability Number

V-31127

Group Title

Information Assurance - Wireless Devices Connected to SIPRNet

Rule Version

IA-11.01.01

Severity

CAT I

CCI(s)

• CCI-000366 - The organization implements the security configuration settings.

Weight

10

Fix Recommendation

Unauthorized wireless devices, such as phones, PEDs, Laptops, etc., must not be connected to the SIPRNet or other classified system/network being reviewed.

Ensure that unauthorized wireless devices (e.g., PEDs) are not connected to the Network (SIPRNet).

NOTE: Portable Electronic Devices (PEDs) include but are not limited to tablets, laptops, smartphones, and cellular telephones.

If Portable Electronic Devices (PEDs) are connected to the SIPRNet, all devices must be NSA approved/configured and meet requirements for Data at Rest (DAR) encryption.

All SIPRNet connected PEDs must comply with requirements in the "Joint USD(I) and DoD CIO Memorandum, dated 25 September 2015, SUBJECT: Security and Operational Guidance for Classified Portable Electronic Devices".

Check Contents

1. Visually check during the walk-around to ensure that unauthorized wireless devices (e.g., PEDs) are not connected to the Network (SIPRNet).

NOTE: Portable Electronic Devices (PEDs) include but are not limited to tablets, laptops, smartphones, and cellular telephones.

2. Consult with Network Reviewers and Wireless Scanners to ensure they have not detected unauthorized wireless devices.

3. If Portable Electronic Devices (PEDs) are found connected to the SIPRNet, verify with both site security personnel, Network Reviewers and others as necessary (e.g., site ISSM) that all devices are NSA approved/configured and meet requirements for Data at Rest (DAR) encryption.

4. Verify that SIPRNet connected PEDs comply with all requirements in the "Joint USD(I) and DoD CIO Memorandum, dated 25 September 2015, SUBJECT: Security and Operational Guidance for Classified Portable Electronic Devices".

TACTICAL ENVIRONMENT: The check is applicable for ALL classified processing environments.

Vulnerability Number

V-31127

Documentable

False

Rule Version

IA-11.01.01

Severity Override Guidance

1. Visually check during the walk-around to ensure that unauthorized wireless devices (e.g., PEDs) are not connected to the Network (SIPRNet).

NOTE: Portable Electronic Devices (PEDs) include but are not limited to tablets, laptops, smartphones, and cellular telephones.

2. Consult with Network Reviewers and Wireless Scanners to ensure they have not detected unauthorized wireless devices.

3. If Portable Electronic Devices (PEDs) are found connected to the SIPRNet, verify with both site security personnel, Network Reviewers and others as necessary (e.g., site ISSM) that all devices are NSA approved/configured and meet requirements for Data at Rest (DAR) encryption.

4. Verify that SIPRNet connected PEDs comply with all requirements in the "Joint USD(I) and DoD CIO Memorandum, dated 25 September 2015, SUBJECT: Security and Operational Guidance for Classified Portable Electronic Devices".

TACTICAL ENVIRONMENT: The check is applicable for ALL classified processing environments.

Check Content Reference

M

Target Key

2506

Comments