The organization must not permit operation of wireless devices in areas where classified information is electronically stored, processed, or transmitted unless operation is in accordance with DAA-approved CTTA restrictions at the site.

From Mobile Policy Security Requirements Guide

Part of SRG-MPOL-038

Associated with: CCI-001330 CCI-001333

SV-47272r1_rule The organization must not permit operation of wireless devices in areas where classified information is electronically stored, processed, or transmitted unless operation is in accordance with DAA-approved CTTA restrictions at the site.

Vulnerability discussion

The operation of electronic equipment and emanations must be controlled in and around areas where sensitive information is kept or processed. Ensure wireless devices are not operated in areas where classified information is electronically stored, processed, or transmitted unless:- Approved by the DAA in consultation with the Certified TEMPEST Technical Authority (CTTA).- The wireless equipment is separated from the classified data equipment at the minimum distance determined by the CTTA, and appropriate countermeasures, as determined by the CTTA, are implemented.

Check content

Review documentation and verify the following. Ask for documentation showing the CTTA was consulted about operation and placement of wireless devices. Acceptable proof would be the signature or initials of the CTTA on the architecture diagram or other evidence of coordination. In accordance with DoD policy, the CTTA must have a written separation policy for each classified area; review written policies, training material, or user agreements to see if wireless usage in these areas is addressed; and verify proper procedures for wireless device use in classified areas is addressed in training programs. If any of the following are identified, this is a finding: - CTTA has not designated a separation distance in writing. - DAA has not coordinated with the CTTA. - Users are not trained or made aware (using signage or user agreement) of procedures for wireless device usage in and around classified processing areas. - Site does not have a written procedure prohibiting the use of wireless devices in areas where classified data processing occurs.

Fix text

Do not permit operation of wireless devices in areas where classified information is electronically stored, processed, or transmitted unless operation is in accordance with DAA-approved CTTA restrictions at the site.

Pro Tips

Lavender hyperlinks in small type off to the right (of CSS class id, if you view the page source) point to globally unique URIs for each document and item. Copy the link location and paste anywhere you need to talk unambiguously about these things.

You can obtain data about documents and items in other formats. Simply provide an HTTP header Accept: text/turtle or Accept: application/rdf+xml.

Powered by sagemincer