Assessment Objective

Determine if:

• PE-16a.
  • PE-16a.[01] [Assignment: types of system components] are authorized when entering the facility;
  • PE-16a.[02] [Assignment: types of system components] are controlled when entering the facility;
  • PE-16a.[03] [Assignment: types of system components] are authorized when exiting the facility;
  • PE-16a.[04] [Assignment: types of system components] are controlled when exiting the facility;
• PE-16b. records of the system components are maintained.

Assessment Methods

Examine

• Physical and environmental protection policy
• procedures addressing the delivery and removal of system components from the facility
• facility housing the system
• records of items entering and exiting the facility
• system security plan
• other relevant documents or records

Interview

• Organizational personnel with responsibilities for controlling system components entering and exiting the facility
• organizational personnel with information security responsibilities

Test

• Organizational process for authorizing, monitoring, and controlling system-related items entering and exiting the facility
• mechanisms supporting and/or implementing, authorizing, monitoring, and controlling system-related items entering and exiting the facility

Ticket collegati

• NIST -

  https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final