Assessment Objective

Determine if:

• the location of CUI is identified and documented.
• the system components on which CUI is processed are identified and documented.
• the system components on which CUI is stored are identified and documented.
• changes to the system or system component location where CUI is processed are documented.
• changes to the system or system component location where CUI is stored are documented.

Assessment Methods

Examine

• configuration management policy and procedures
• configuration management plan
• procedures for identification and documentation of information location
• system audit records
• architecture documentation
• system design documentation
• list of users with system and system component access
• change control records
• system component inventory
• system security plan
• other relevant documents or records

Interview

• personnel with responsibilities for managing information location and user access
• personnel with responsibilities for operating, using, or maintaining the system
• personnel with information security responsibilities
• system developers
• system administrators

Test

• processes governing information location
• mechanisms for enforcing policies and methods for governing information location

Povezane zadeve

• NIST -

  https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final