Assessment Objective
Determine if:
- PE-16a.
- PE-16a.[01] [Assignment: types of system components] are authorized when entering the facility;
- PE-16a.[02] [Assignment: types of system components] are controlled when entering the facility;
- PE-16a.[03] [Assignment: types of system components] are authorized when exiting the facility;
- PE-16a.[04] [Assignment: types of system components] are controlled when exiting the facility;
- PE-16b. records of the system components are maintained.
Assessment Methods
Examine
- Physical and environmental protection policy
- procedures addressing the delivery and removal of system components from the facility
- facility housing the system
- records of items entering and exiting the facility
- system security plan
- other relevant documents or records
Interview
- Organizational personnel with responsibilities for controlling system components entering and exiting the facility
- organizational personnel with information security responsibilities
Test
- Organizational process for authorizing, monitoring, and controlling system-related items entering and exiting the facility
- mechanisms supporting and/or implementing, authorizing, monitoring, and controlling system-related items entering and exiting the facility
Incidencias vinculadas
| Tipo de vínculo | Incidencia |
|---|---|
| blocks | PE-16 [M] Delivery and Removal |