UCF STIG Viewer Logo

Information Assurance - SIPRNET Connection Approval Process (CAP)


Overview

Finding ID Version Rule ID IA Controls Severity
V-31091 IA-09.02.01 SV-41178r2_rule DCID-1 EBCR-1 Medium
Description
Failure to provide current connection documentation to the Classified Connection Approval Office (CCAO) and allowing a system to connect and operate without a current CCAO approval can result in a vulnerability to all SIPRNet connected systems on the DISN.
STIG Date
Traditional Security 2013-07-11

Details

Check Text ( C-39724r4_chk )
1. Check to ensure the site provided the Classified Connection Approval Office (CCAO), current certification documentation IAW CCAO guidance.

2. In addition check to ensure the site also has notified the CCAO of any changes/modification to the approved architecture.

3. Check to ensure the approval to connect (ATC) or Interim Approval to Connect (IATC) is current.

TACTICAL ENVIRONMENT: The check is applicable. The ATC and associated documentation should be found in a fixed HQ location where the IAM/IAO are located. When possible, documentation should be requested/sought before departing on trips to tactical locations. Copies sent to the reviewers email (NIPR or SIPR depending on classification of document) can be used to validate compliance.
Fix Text (F-34922r3_fix)
1. The Classified Connection Approval Office (CCAO) must be provided with current certification documentation IAW CCAO guidance.

2. The CCAO must be notified in writing of any changes/modification to the approved architecture.

3. The approval to connect (ATC) or Interim Approval to Connect (IATC) must be current.