Title

The organization must create a policy and procedures document for proper handling and transport of data entering (physically or electronically) the test and development environment. (Cat II impact)

Discussion

Without policies and procedures in place, the organization will not have the authority to hold personnel accountable for improperly handling or transporting data into the test and development environment. The documents need to include guidance for both physical and electronic data migration.

Check Content

Review the organization's policies and procedures document to ensure proper handling of data being transported into the test and development environment. This document must include information for physical and electronic migration of data. If the organization does not have a policy and procedures document created or available for review, this is a finding.

Fix Text

Create a policy for, and document the procedure of, proper handling of data transported into the test and development environment. This document must include information for physical and electronic handling and migration of data.

Additional Identifiers

Rule ID: SV-56070r1_rule

Vulnerability ID: V-43317

Group Title: ENTD0370 - Policy and procedures document not created for proper data handling.

Expert Comments

CCIs tied to check.

Controls tied to check. These are derived from the CCIs shown above.