The organization must review and update the Voice Video security architecture annually to reflect updates in the enterprise architecture.

From Voice Video Policy Security Technical Implementation Guide

Part of SRG-POL-300615

Associated with: CCI-003076

VVSP-01-000178_rule The organization must review and update the Voice Video security architecture annually to reflect updates in the enterprise architecture.

Vulnerability discussion

The information security architecture at the individual information system level must be consistent with and complement the more global, organization-wide information security architecture that is integral to and developed as part of the enterprise architecture. The information security architecture includes an architectural description, the placement/allocation of security functionality (including security controls), security-related information for external interfaces, information being exchanged across the interfaces, and the protection mechanisms associated with each interface.In addition, the security architecture can include other important security-related information, for example, user roles and access privileges assigned to each role; unique security requirements; the types of information processed, stored, and transmitted by the information system; restoration priorities of information and information system services; and any other specific protection needs.Voice Video systems developed and fielded at sites must be compatible and comparable to all DoD implementations. Because unclassified Voice Video systems are used broadly, including within facilities where classified information is handled and discussed, a number of technical, policy, and architectural considerations must be addressed. At the organizational level, call plans and routing details must be documented, disseminated, and implemented at all levels. All unclassified Voice Video communication must be treated as Controlled Unclassified Information (CUI) at a minimum. Local sites may sometimes be removed from recent changes at the enterprise level, allowing risks to continue. This is especially dangerous for tactical OCONUS locations, which many times are direct targets of adversaries.

Check content

Review the organizational Voice Video training plan audit trail of reviews and updates to confirm the organization reviews and updates the Voice Video security architecture annually to reflect updates in the enterprise architecture. If the organizational Voice Video training plan audit trail of reviews and updates does not confirm annual review and update, this is a finding.

Fix text

Annually review the organizational Voice Video security architecture to reflect updates in the enterprise architecture. Update the Voice Video security architecture as appropriate. Maintain an audit trail of review and update activity.

Pro Tips

Powered by sagemincer