CCI-001023

Implementation Guidance

Determine if accountability for system media is maintained during transport outside of controlled areas.

Validation Procedures

"Examine: [SELECT FROM: System media protection policy; procedures addressing media storage; physical and environmental protection policy and procedures; access control policy and procedures; authorized personnel list; system media; designated controlled areas; system security plan; other relevant documents or records]. Interview: [SELECT FROM: Organizational personnel with system media protection and storage responsibilities; organizational personnel with information security responsibilities; system/network administrators]. Test: [SELECT FROM: Organizational processes for storing information media; mechanisms supporting and/or implementing media storage/media protection]."