+CM-12 Information Location
---+CM-12(01) Automated Tools to Support Information Location

CM-12 Information Location

Control

  1. Identify and document the location of [Assignement: information] and the specific system components on which the information is processed and stored;
  2. Identify and document the users who have access to the system and system components where the information is processed and stored; and
  3. Document changes to the location (i.e., system or system components) where the information is processed and stored.

Discussion

Information location addresses the need to understand where information is being processed and stored. Information location includes identifying where specific information types and information reside in system components and how information is being processed so that information flow can be understood and adequate protection and policy management provided for such information and system components. The security category of the information is also a factor in determining the controls necessary to protect the information and the system component where the information resides (see [FIPS 199](#628d22a1-6a11-4784-bc59-5cd9497b5445) ). The location of the information and system components is also a factor in the architecture and design of the system (see [SA-4](#sa-4), [SA-8](#sa-8), [SA-17](#sa-17)).

Assessment Objective

    1. the location of [Assignement: information] is identified and documented;
    2. the specific system components on which [Assignement: information] is processed are identified and documented;
    3. the specific system components on which [Assignement: information] is stored are identified and documented;
    1. the users who have access to the system and system components where [Assignement: information] is processed are identified and documented;
    2. the users who have access to the system and system components where [Assignement: information] is stored are identified and documented;
    1. changes to the location (i.e., system or system components) where [Assignement: information] is processed are documented;
    2. changes to the location (i.e., system or system components) where [Assignement: information] is stored are documented.

Assessment Method

Examine

Configuration management policy procedures addressing identification and documentation of information location configuration management plan system design documentation system architecture documentation PII inventory documentation data mapping documentation audit records list of users with system and system component access change control records system component inventory system security plan privacy plan other relevant documents or records

Interview

Organizational personnel with responsibilities for managing information location and user access to information organizational personnel with responsibilities for operating, using, and/or maintaining the system organizational personnel with information security and privacy responsibilities system/network administrators system developers

1. Oversigt

CM-12(01) Automated Tools to Support Information Location

Control

Use automated tools to identify [Assignement: information by information type] on [Assignement: system components] to ensure controls are in place to protect organizational information and individual privacy.

Discussion

The use of automated tools helps to increase the effectiveness and efficiency of the information location capability implemented within the system. Automation also helps organizations manage the data produced during information location activities and share such information across the organization. The output of automated information location tools can be used to guide and inform system architecture and design decisions.

Assessment Objective

automated tools are used to identify [Assignement: information by information type] on [Assignement: system components] to ensure that controls are in place to protect organizational information and individual privacy.

Assessment Method

Examine

Configuration management policy procedures addressing identification and documentation of information location configuration management plan system design documentation PII inventory documentation data mapping documentation change control records system component inventory system security plan privacy plan other relevant documents or records

Interview

Organizational personnel with responsibilities for managing information location organizational personnel with information security responsibilities system/network administrators system developers

1.1 Referencer

1.2 Identificerede krav

1.3 Relaterede reguleringer

2. Identificerede krav

Krav

3. Relaterede reguleringer

Reguleringer

Linkede sager

Sagslinks
is blocked by CM-12 Information Location – Assessment Procedure
is blocked by Logical Data Location