CCI-001003

Restrict access to organization-defined types of digital and/or non-digital media to organization-defined personnel or roles.

Implementation Guidance

The organization being inspected/assessed restricts access to all types of digital and/or non-digital media containing information not cleared for public release to the personnel or roles defined in MP-2, CCI 1005. DoD has defined the types of digital and non-digital media as all types of digital and/or non-digital media containing information not cleared for public release.

Validation Procedures

The organization conducting the inspection/assessment interviews organizational personnel with information system media protection responsibilities to ensure the organization being inspected/assessed restricts access to all types of digital and/or non-digital media containing information not cleared for public release to the personnel or roles defined in MP-2, CCI 1005. DoD has defined the types of digital and non-digital media as all types of digital and/or non-digital media containing information not cleared for public release.

Compelling Evidence

1.) Documentation to ensure that all types of digital and/or non-digital media containing information not cleared for public release are restricted to personnel or roles as outlined in DoD 5200.01-M, CTO 10-133, and CTO 08-001. 2.) Training documentation to ensure organization personnel with information system media protection responsibilities are trained on information system media access restrictions outlined in DoD 5200.01-M, CTO 10-133, and CTO 08-001.

The controls below (if any) were marked by NIST as being related to CCI-001003.