At the ACS and DS, devices that give personnel non-console access to HSMs are kept in a designated secure area watched at all times and locked away (room, rack, cabinet, drawer or safe) when idle; physical access to them is limited to authorised people under dual control; their authentication tokens (smart cards, dongles) are locked away when not in use; operating them needs dual control and multi-factor authentication; they carry only necessary software and current security configurations; they cannot connect to other networks while linked to the HSM; and they are cryptographically authenticated before being allowed to use HSM functions. (Under the Technical FAQ Q3 alternative, secret and private keys and components entering or leaving the HSM are protected by dual control and split knowledge.) The assessor observes device locations, device configurations and HSM authentication mechanisms.
This control maps to 1 controls across 1 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.
The graph holds this control, the 1 it maps to, and the evidence behind each claim, over MCP and REST.