Under active development Content is continuously updated and improved

03.04.12System and Component Configuration for High-Risk Areas

>Control Description

Issue systems or system components with the following configurations to individuals traveling to high-risk locations: organization-defined system configurations. Apply the following security requirements to the systems or components when the individuals return from travel: organization-defined security requirements.

>Assessment Interview Topics

Questions assessors commonly ask

Process & Governance:

  • What documented policies and procedures address 03.04.12?
  • Who is accountable for implementing and maintaining 03.04.12 controls?
  • How frequently are 03.04.12 requirements reviewed, and what triggers updates?
  • What process ensures changes to systems maintain compliance with 03.04.12 requirements?
  • How are exceptions to 03.04.12 requirements documented and approved?

Technical Implementation:

  • What technical controls enforce 03.04.12 in your environment?
  • How are 03.04.12 controls configured and maintained across all systems?
  • What automated mechanisms support 03.04.12 compliance?
  • How do you validate that 03.04.12 implementations achieve their intended security outcome?
  • What compensating controls exist if primary 03.04.12 controls cannot be fully implemented?

Evidence & Documentation:

  • What documentation proves 03.04.12 is implemented and operating effectively?
  • Can you provide configuration evidence showing how 03.04.12 is technically enforced?
  • What audit logs or monitoring data demonstrate ongoing 03.04.12 compliance?
  • Can you show evidence of a recent review or assessment of 03.04.12 controls?
  • What artifacts would you provide during an assessment to demonstrate 03.04.12 compliance?

Ask AI

Configure your API key to use AI features.