Assessment Objective

Determine if:

• policies needed to satisfy the security requirements for the protection of CUI are developed and documented.
• policies needed to satisfy the security requirements for the protection of CUI are disseminated to organizational personnel or roles.
• procedures needed to satisfy the security requirements for the protection of CUI are developed and documented.
• procedures needed to satisfy the security requirements for the protection of CUI are disseminated to organizational personnel or roles.
• policies and procedures are reviewed [Assignment: frequency].
• policies and procedures are updated [Assignment: frequency].

Assessment Methods

Examine

• security policies and procedures associated with the protection of CUI
• audit findings
• system security plan
• other relevant documents or records

Interview

• personnel with information security responsibilities

Linked Issues

• NIST -

  https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final