03.04.11 Information Location

Statement

• a. Identify and document the location of CUI and the system components on which the information is processed and stored.

• b. Document changes to the system or system component location where CUI is processed and stored.

Guidance

Information location addresses the need to understand the specific system components where CUI is being processed and stored and the users who have access to CUI so that appropriate protection mechanisms can be provided, including information flow controls, access controls, and information management.

Assessment objective

the location of CUI is identified and documented.

Assessment objective

the system components on which CUI is processed are identified and documented.

Assessment objective

the system components on which CUI is stored are identified and documented.

Assessment objective

changes to the system or system component location where CUI is processed are documented.

Assessment objective

changes to the system or system component location where CUI is stored are documented.

Assessment method

• configuration management policy and procedures configuration management plan procedures for identification and documentation of information location system audit records architecture documentation system design documentation list of users with system and system component access change control records system component inventory system security plan other relevant documents or records

Assessment method

• personnel with responsibilities for managing information location and user access personnel with responsibilities for operating, using, or maintaining the system personnel with information security responsibilities system developers system administrators

Assessment method

• processes governing information location mechanisms for enforcing policies and methods for governing information location

1. Översikt

1.1 Referenser

1.2 Identifierade krav

1.3 Relaterade regleringar

2. Identifierade krav

3. Relaterade regleringar

Länkade ärenden

• NIST -

  https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final