Title

Physical security of the Automated Information System (AIS) does not meet DISA requirements. (Cat II impact)

Discussion

Inadequate physical protection can undermine all other security precautions utilized to protect the system. This can jeopardize the confidentiality, availability, and integrity of the system. Physical security of the AIS is the first line protection of any system.

Check Content

Interview the SA to determine if equipment is located in an access controlled area. Note: Servers will be located in rooms, or locked cabinets, that are accessible only to authorized systems personnel. Authorized user access should be verified at two points (i.e. building access and server room). User workstations containing sensitive data should be in access controlled areas.

Fix Text

Relocate equipment to a controlled access area.

Additional Identifiers

Rule ID: SV-29618r1_rule

Vulnerability ID: V-1070

Group Title: Physical security

Expert Comments

CCIs tied to check.

Controls tied to check. These are derived from the CCIs shown above.