Title

Production virtual machines are not located in a controlled access area. (Cat II impact)

Discussion

Virtual machines may contain an aggregate of sensitive and non-sensitive data. If this data is not located in a controlled access area, unauthorized users may gain access to the virtual machines and have access to the data. This access may result in the loss of privacy and data theft.

Check Content

Review the location of the virtual machines. Ensure that authorized users are required to verify their identity and authority before gaining access to the virtual machines. If the virtual machines are not located in a controlled access area, this is a finding.

Fix Text

Place all virtual machines in a controlled access area.

Additional Identifiers

Rule ID: SV-16846r1_rule

Vulnerability ID: V-15904

Group Title: Production virtual machines not in controlled area

Expert Comments

CCIs tied to check.

Controls tied to check. These are derived from the CCIs shown above.