CA-3(3): Unclassified Non-National Security System Connections

Control Family:

Security Assessment And Authorization

Parent Control:

CA-3: System Interconnections

Priority:

P1: Implement P1 security controls first.

CSF v1.1 References:

Baselines:

(Not part of any baseline)

Control is withdrawn in the next version of this control set and incorporated into: SC-7(27): Unclassified Non-national Security System Connections.

Control Statement

The organization prohibits the direct connection of an [Assignment: organization-defined unclassified, non-national security system] to an external network without the use of [Assignment; organization-defined boundary protection device].

Supplemental Guidance

Organizations typically do not have control over external networks (e.g., the Internet). Approved boundary protection devices (e.g., routers, firewalls) mediate communications (i.e., information flows) between unclassified non-national security systems and external networks. This control enhancement is required for organizations processing, storing, or transmitting Controlled Unclassified Information (CUI).