All network infrastructure devices must be located in a secure room with limited access.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-251363	NET0210	SV-251363r806044_rule		Medium

Description
If all communications devices are not installed within controlled access areas, risk of unauthorized access and equipment failure exists, which could result in denial of service or security compromise. It is not sufficient to limit access to only the outside world or non-site personnel. Not everyone within the site has the need-to-know or the need-for-access to communication devices.

STIG	Date
Network Infrastructure Policy Security Technical Implementation Guide	2021-11-22

Details

Check Text ( C-54798r806042_chk )
Inspect the site to validate physical network components are in a secure environment with limited access. If there are any network components not located in a secure environment, this is a finding.

Fix Text (F-54751r806043_fix)
Move all critical communications into controlled access areas. Controlled access area in this case means controlled restriction to authorize site personnel, i.e., dedicated communications rooms or locked cabinets. This is an area afforded entry control at a security level commensurate with the operational requirement. This protection will be sufficient to protect the network from unauthorized personnel. The keys to the locked cabinets and dedicated communications rooms will be controlled and only provided to authorized network/network security individuals.

Fix Text (F-54751r806043_fix)

Move all critical communications into controlled access areas. Controlled access area in this case means controlled restriction to authorize site personnel, i.e., dedicated communications rooms or locked cabinets. This is an area afforded entry control at a security level commensurate with the operational requirement. This protection will be sufficient to protect the network from unauthorized personnel. The keys to the locked cabinets and dedicated communications rooms will be controlled and only provided to authorized network/network security individuals.