Assessment Objective
Determine if:
- CM-12a.
- CM-12a.[01] the location of [Assignment: information] is identified and documented;
- CM-12a.[02] the specific system components on which [Assignment: information] is processed are identified and documented;
- CM-12a.[03] the specific system components on which [Assignment: information] is stored are identified and documented;
- CM-12b.
- CM-12b.[01] the users who have access to the system and system components where [Assignment: information] is processed are identified and documented;
- CM-12b.[02] the users who have access to the system and system components where [Assignment: information] is stored are identified and documented;
- CM-12c.
- CM-12c.[01] changes to the location (i.e., system or system components) where [Assignment: information] is processed are documented;
- CM-12c.[02] changes to the location (i.e., system or system components) where [Assignment: information] is stored are documented.
Assessment Methods
Examine
- Configuration management policy
- procedures addressing identification and documentation of information location
- configuration management plan
- system design documentation
- system architecture documentation
- PII inventory documentation
- data mapping documentation
- audit records
- list of users with system and system component access
- change control records
- system component inventory
- system security plan
- privacy plan
- other relevant documents or records
Interview
- Organizational personnel with responsibilities for managing information location and user access to information
- organizational personnel with responsibilities for operating, using, and/or maintaining the system
- organizational personnel with information security and privacy responsibilities
- system/network administrators
- system developers
Test
- Organizational processes governing information location
- mechanisms enforcing policies and methods for governing information location
Saincheisteanna nasctha
| Cineál naisc | Saincheist |
|---|---|
| blocks | CM-12 [M] Information Location |