Assessment Objective
Determine if:
- PE-17a. [Assignment: alternate work sites] are determined and documented;
- PE-17b. [Assignment: controls] are employed at alternate work sites;
- PE-17c. the effectiveness of controls at alternate work sites is assessed;
- PE-17d. a means for employees to communicate with information security and privacy personnel in case of incidents is provided.
Assessment Methods
Examine
- Physical and environmental protection policy
- procedures addressing alternate work sites for organizational personnel
- list of security controls required for alternate work sites
- assessments of security controls at alternate work sites
- system security plan
- privacy plan
- other relevant documents or records
Interview
- Organizational personnel approving the use of alternate work sites
- organizational personnel using alternate work sites
- organizational personnel assessing controls at alternate work sites
- organizational personnel with information security and privacy responsibilities
Test
- Organizational processes for security and privacy at alternate work sites
- mechanisms supporting alternate work sites
- security and privacy controls employed at alternate work sites
- means of communication between personnel at alternate work sites and security and privacy personnel
Linkede sager
| Linktype | Sag |
|---|---|
| blocks | PE-17 [M] Alternate Work Site |