myctrl.tools
Compare

AC-19(4)—Restrictions For Classified Information

>Control Description

a

Prohibit the use of unclassified mobile devices in facilities containing systems processing, storing, or transmitting classified information unless specifically permitted by the authorizing official; and

b

Enforce the following restrictions on individuals permitted by the authorizing official to use unclassified mobile devices in facilities containing systems processing, storing, or transmitting classified information:

1.

Connection of unclassified mobile devices to classified systems is prohibited;

2.

Connection of unclassified mobile devices to unclassified systems requires approval from the authorizing official;

3.

Use of internal or external modems or wireless interfaces within the unclassified mobile devices is prohibited; and

4.

Unclassified mobile devices and the information stored on those devices are subject to random reviews and inspections by ⚙organization-defined security officials, and if classified information is found, the incident handling policy is followed.

c

Restrict the connection of classified mobile devices to classified systems in accordance with ⚙organization-defined security policies.

>Supplemental Guidance

None.

>Related Controls

CM-8
IR-4

>Assessment Interview Topics

Questions assessors commonly ask

Process & Governance:

  • •What formal policies and procedures govern the implementation of AC-19(4) (Restrictions For Classified Information)?
  • •Who are the designated roles responsible for implementing, maintaining, and monitoring AC-19(4)?
  • •How frequently is the AC-19(4) policy reviewed and updated, and what triggers policy changes?
  • •What training or awareness programs ensure personnel understand their responsibilities related to AC-19(4)?

Technical Implementation:

  • •Describe the specific technical mechanisms or controls used to enforce AC-19(4) requirements.
  • •What automated tools, systems, or technologies are deployed to implement AC-19(4)?
  • •How is AC-19(4) integrated into your system architecture and overall security posture?
  • •What configuration settings, parameters, or technical specifications enforce AC-19(4) requirements?

Evidence & Documentation:

  • •What documentation demonstrates the complete implementation of AC-19(4)?
  • •What audit logs, records, reports, or monitoring data validate AC-19(4) compliance?
  • •Can you provide evidence of periodic reviews, assessments, or testing of AC-19(4) effectiveness?
  • •What artifacts would you present during a FedRAMP assessment to demonstrate AC-19(4) compliance?

Ask AI

Configure your API key to use AI features.