Information Assurance - SIPRNET Connection Approval Process (CAP)

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-31091	IA-09.02.01	SV-41178r2_rule	DCID-1 EBCR-1	Medium

Description
Failure to provide current connection documentation to the Classified Connection Approval Office (CCAO) and allowing a system to connect and operate without a current CCAO approval can result in a vulnerability to all SIPRNet connected systems on the DISN.

STIG	Date
Traditional Security	2013-07-11

Details

Check Text ( C-39724r4_chk )
1. Check to ensure the site provided the Classified Connection Approval Office (CCAO), current certification documentation IAW CCAO guidance. 2. In addition check to ensure the site also has notified the CCAO of any changes/modification to the approved architecture. 3. Check to ensure the approval to connect (ATC) or Interim Approval to Connect (IATC) is current. TACTICAL ENVIRONMENT: The check is applicable. The ATC and associated documentation should be found in a fixed HQ location where the IAM/IAO are located. When possible, documentation should be requested/sought before departing on trips to tactical locations. Copies sent to the reviewers email (NIPR or SIPR depending on classification of document) can be used to validate compliance.

Check Text ( C-39724r4_chk )

1. Check to ensure the site provided the Classified Connection Approval Office (CCAO), current certification documentation IAW CCAO guidance.

2. In addition check to ensure the site also has notified the CCAO of any changes/modification to the approved architecture.

3. Check to ensure the approval to connect (ATC) or Interim Approval to Connect (IATC) is current.

TACTICAL ENVIRONMENT: The check is applicable. The ATC and associated documentation should be found in a fixed HQ location where the IAM/IAO are located. When possible, documentation should be requested/sought before departing on trips to tactical locations. Copies sent to the reviewers email (NIPR or SIPR depending on classification of document) can be used to validate compliance.

Fix Text (F-34922r3_fix)
1. The Classified Connection Approval Office (CCAO) must be provided with current certification documentation IAW CCAO guidance. 2. The CCAO must be notified in writing of any changes/modification to the approved architecture. 3. The approval to connect (ATC) or Interim Approval to Connect (IATC) must be current.