Assessment Objective

Determine if:

• PE-05(02) individual identity is linked to the receipt of output from output devices.

Assessment Methods

Examine

• Physical and environmental protection policy
• procedures addressing physical access control
• system design documentation
• system configuration settings and associated documentation
• list of output devices and associated outputs requiring physical access controls
• physical access control logs or records for areas containing output devices and related outputs
• system audit records
• system security plan
• privacy plan
• privacy impact assessment
• privacy risk assessment documentation
• other relevant documents or records

Interview

• Organizational personnel with physical access control responsibilities
• organizational personnel with information security and privacy responsibilities
• system/network administrators
• system developers

Test

• Organizational processes for access control to output devices
• mechanisms supporting and/or implementing access control to output devices

Ticket collegati

• NIST -

  https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final