| If endpoint devices used to access restricted networks and systems are not compliant with security policies and able to pass policy assessment then privileged information and systems may be at immediate risk. Devices are government owned (GFE), contractor owned, or personally owned. Devices are categorized as government owned (GFE), contractor owned, or personally owned.
A personally-owned device is not managed, owned, or leased by the government. Personally owned devices do not meet DoD security standards for privileged access. This type of access from an untrusted device puts the network at immediate risk since these devices may have ensured confidentiality and integrity requirements. These devices may be managed devices. However, even when subjected to policy assessment, personally owned devices are not allowed for processing classified or for remote access to privileged data or functions. The intention is to allow approved and limited usage (e.g., for email). However, note that a policy assessment solution must be in place for all unmanaged devices to enter trusted zones.
Contractor owned endpoints are provided in compliance with a government contract to perform management services. These endpoints must be STIG compliant using the OS STIG and other applicable STIGs and must follow DoD requirements for remaining compliant. The configuration and connection method for privileged access must also comply with government confidentiality and integrity requirements. Thus, the configuration of devices must be approved by the government as STIG compliant and kept up to date. Remote access for these devices must meet network access control and automated policy assessment requirements. |
