+PM-17 Protecting Controlled Unclassified Information on External Systems

PM-17 Protecting Controlled Unclassified Information on External Systems

Control

  1. Establish policy and procedures to ensure that requirements for the protection of controlled unclassified information that is processed, stored or transmitted on external systems, are implemented in accordance with applicable laws, executive orders, directives, policies, regulations, and standards; and
  2. Review and update the policy and procedures [Assignement: organization-defined frequency].

Discussion

Controlled unclassified information is defined by the National Archives and Records Administration along with the safeguarding and dissemination requirements for such information and is codified in [32 CFR 2002](#91f992fb-f668-4c91-a50f-0f05b95ccee3) and, specifically for systems external to the federal organization, [32 CFR 2002.14h](https://www.govinfo.gov/content/pkg/CFR-2017-title32-vol6/xml/CFR-2017-title32-vol6-part2002.xml) . The policy prescribes the specific use and conditions to be implemented in accordance with organizational procedures, including via its contracting processes.

Assessment Objective

    1. policy is established to ensure that requirements for the protection of controlled unclassified information that is processed, stored, or transmitted on external systems are implemented in accordance with applicable laws, executive orders, directives, policies, regulations, and standards;
    2. procedures are established to ensure that requirements for the protection of controlled unclassified information that is processed, stored, or transmitted on external systems are implemented in accordance with applicable laws, executive orders, directives, policies, regulations, and standards;
    1. policy is reviewed and updated [Assignement: frequency];
    2. procedures are reviewed and updated [Assignement: frequency]

Assessment Method

Examine

Controlled unclassified information policy controlled unclassified information procedures other relevant documents or records.

Interview

Organizational personnel with controlled unclassified information responsibilities organizational personnel with information security responsibilities.

1. Ħarsa ġenerali

1.1 Referenzi

1.2 Rekwiżiti identifikati

1.3 Regolamenti relatati

2. Rekwiżiti identifikati

Rekwiżiti

3. Regolamenti relatati

Regolamenti

Kwistjonijiet marbuta

Links
is blocked by PM-17 Protecting Controlled Unclassified Information on External Systems – Assessment Procedure
is blocked by Protecting Sensitive / Regulated Data on External Technology Assets, Applications and/or Services (TAAS)