If DAA has approved the use of personally-owned PEDs, the owner must sign a forfeiture agreement in case of a security incident.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-28314	WIR0010-02	SV-36042r2_rule	ECSC-1 ECWN-1	Low

Description
The use of unauthorized personally-owned wireless devices to receive, store, process or transmit DoD data could expose sensitive DoD data to unauthorized people. The use of personally-owned PEDs must be controlled by the site. Users must agree to forfeit the PED when security incidents occur, follow all required security procedures, and install required software in order to protect the DoD network.

Description

The use of unauthorized personally-owned wireless devices to receive, store, process or transmit DoD data could expose sensitive DoD data to unauthorized people. The use of personally-owned PEDs must be controlled by the site. Users must agree to forfeit the PED when security incidents occur, follow all required security procedures, and install required software in order to protect the DoD network.

STIG	Date
Final Draft General Wireless Policy Security Technical Implementation Guide	2011-09-30

Details

Check Text ( C-35839r2_chk )
When personally-owned PEDs are used to transmit, receive, store, or process DoD information, the owner must sign a forfeiture agreement in case of a security incident. The reviewer should obtain a copy of the signed forfeiture agreement for a sample of users (2-3) that have been approved to use personally owned devices.

Fix Text (F-30411r2_fix)
If the DAA has approved the use of personally-owned PEDs, have the owner sign a forfeiture agreement in case of a security incident.