Assessment Objective
Determine if:
- system media that contain CUI are protected during transport outside of controlled areas.
- system media that contain CUI are controlled during transport outside of controlled areas.
- activities associated with the transport of system media that contain CUI are documented.
- accountability for system media that contain CUI is maintained during transport outside of controlled areas.
Assessment Methods
Examine
- physical protection policy and procedures
- media protection policy and procedures
- procedures for media storage
- access control policy and procedures
- authorized personnel list
- system media
- designated controlled areas
- system and communications protection policy and procedures
- cryptographic mechanisms and configuration documentation
- procedures for the protection of information at rest
- system design documentation
- system configuration settings
- list of information at rest requiring confidentiality protections
- system audit records
- system security plan
- other relevant documents or records
Interview
- personnel with system media protection and storage responsibilities
- personnel with information security responsibilities
- system developers
- system administrators
Test
- processes for storing information media
- mechanisms for supporting or implementing media storage/media protection
- mechanisms for supporting or implementing confidentiality protections for information at rest
Länkade ärenden
| Länktyp | Ärende |
|---|---|
| blocks | 03.08.05 Media Transport |