STIGQter: STIG Summary: Traditional Security Checklist Version: 1 Release: 3 Benchmark Date: 15 Jun 2020: STIGQter: STIG Summary: Traditional Security Checklist Version: 1 Release: 3 Benchmark Date: 15 Jun 2020:SV-41545r3_rule
V-31278
Information Security (INFOSEC) - Secure Room Standards - Random Checks
IS-02.01.10
CAT I
10
Background:
This requirement is concerned with using random checks as the required supplemental control of secure room/collateral classified open storage area space (containing SIPRNet assets) - instead of IDS.
Fixes:
1. Use of random checks in lieu of IDS must be supported by a valid risk assessment (addressing each secure room or area) that specifically considers the threat, vulnerabilities, security-in-depth countermeasures, acceptability of risk, potential cost savings, procedural requirements, and potential cost of additional manpower associated with random checks of the secure areas - as an alternative to IDS.
2. The frequency of random checks must not exceed 4-hours when the secure area space is not attended.
3. Checks must be conducted by guards/employees who are cleared to at least the Secret level.
4. Checks must be conducted of each door (primary and all secondary), each window, and each opening exceeding 96 square inches (which are required to be protected with either bars, expanded metal grills, commercial metal sounds baffles) to ensure they are properly secured. Additionally all traversable space surrounding the exterior of the Secure Room must be viewed by the checker by walking around the entire perimeter.
5. Checks must be supported by written procedures/instructions for the checkers and results of checks must be recorded.
6. Locally developed checklists or the Standard Form (SF) 701 must be used to document checks. Completed checklists should be maintained on-hand for at least 90-days as an audit trail or indefinitely if discrepancies were noted during any checks.
It is important to note that random checks are an allowable alternative to IDS *ONLY* if supported by a valid risk assessment AND security-in-depth countermeasures as determined in writing by the CC/S/A senior agency official (SAO)(INFOSEC). Not meeting this requirement will result in a finding.
Use of IDS and risk analysis are each covered as separate checks elsewhere in this document.
This particular requirement (random checks of secure rooms) is Not Applicable (NA) if IDS is used.
In summary this requirement is intended to implement and validate that random checks not exceeding 4-hours are being used AND that it is supported by a valid risk assessment along with security-in-depth countermeasures.
Background:
This check is concerned with using random checks as the required supplemental control of secure room/collateral classified open storage area space (containing SIPRNet assets) - instead of IDS.
Checks:
Check #1. Use of random checks in lieu of IDS must be supported by a valid risk assessment (addressing each secure room or area) that specifically considers the threat, vulnerabilities, security-in-depth countermeasures, acceptability of risk, potential cost savings, procedural requirements, and potential cost of additional manpower associated with random checks of the secure areas - as an alternative to IDS.
Check #2. The frequency of random checks shall not exceed 4-hours when the secure area space is not attended.
Check #3. Checks must be conducted by guards/employees who are cleared to at least the Secret level.
Check #4. Checks will be conducted of each door (primary and all secondary), each window, and each opening exceeding 96 square inches (which are required to be protected with either bars, expanded metal grills, commercial metal sounds baffles) to ensure they are properly secured. Additionally all traversable space surrounding the exterior of the Secure Room should be viewed by the checker by walking around the entire perimeter.
Check #5. Checks must be supported by written procedures/instructions for the checkers and results of checks must be recorded.
Check #6. Locally developed checklists or the Standard Form (SF) 701 must be used to document checks. Completed checklists should be maintained on-hand for at least 90-days as an audit trail or indefinitely if discrepancies were noted during any checks.
It is important to note that random checks are an allowable alternative to IDS *ONLY* if supported by a valid risk assessment AND security-in-depth countermeasures as determined in writing by the C/S/A senior security official. Otherwise this is a finding.
Use of IDS and risk analysis are each covered as separate checks elsewhere in this document.
This particular check (random checks of secure rooms) is Not Applicable (NA) if IDS is used.
In summary this check must validate that random checks not exceeding 4-hours are being used AND that it is supported by a valid risk assessment along with security-in-depth countermeasures.
TACTICAL ENVIRONMENT: This check is applicable where Secure Rooms are used to protect classified materials or systems in a tactical environment. The only exception will be for urgent (short term) tactical operations or other contingency situations where fixed facilities and equipment are not yet present or incapable of being used.
V-31278
False
IS-02.01.10
Background:
This check is concerned with using random checks as the required supplemental control of secure room/collateral classified open storage area space (containing SIPRNet assets) - instead of IDS.
Checks:
Check #1. Use of random checks in lieu of IDS must be supported by a valid risk assessment (addressing each secure room or area) that specifically considers the threat, vulnerabilities, security-in-depth countermeasures, acceptability of risk, potential cost savings, procedural requirements, and potential cost of additional manpower associated with random checks of the secure areas - as an alternative to IDS.
Check #2. The frequency of random checks shall not exceed 4-hours when the secure area space is not attended.
Check #3. Checks must be conducted by guards/employees who are cleared to at least the Secret level.
Check #4. Checks will be conducted of each door (primary and all secondary), each window, and each opening exceeding 96 square inches (which are required to be protected with either bars, expanded metal grills, commercial metal sounds baffles) to ensure they are properly secured. Additionally all traversable space surrounding the exterior of the Secure Room should be viewed by the checker by walking around the entire perimeter.
Check #5. Checks must be supported by written procedures/instructions for the checkers and results of checks must be recorded.
Check #6. Locally developed checklists or the Standard Form (SF) 701 must be used to document checks. Completed checklists should be maintained on-hand for at least 90-days as an audit trail or indefinitely if discrepancies were noted during any checks.
It is important to note that random checks are an allowable alternative to IDS *ONLY* if supported by a valid risk assessment AND security-in-depth countermeasures as determined in writing by the C/S/A senior security official. Otherwise this is a finding.
Use of IDS and risk analysis are each covered as separate checks elsewhere in this document.
This particular check (random checks of secure rooms) is Not Applicable (NA) if IDS is used.
In summary this check must validate that random checks not exceeding 4-hours are being used AND that it is supported by a valid risk assessment along with security-in-depth countermeasures.
TACTICAL ENVIRONMENT: This check is applicable where Secure Rooms are used to protect classified materials or systems in a tactical environment. The only exception will be for urgent (short term) tactical operations or other contingency situations where fixed facilities and equipment are not yet present or incapable of being used.
M
2506