CCI-001528

Initiate organization-defined transfer or reassignment actions within an organization-defined time period following the formal personnel transfer action.

Implementation Guidance

The organization being inspected/assessed initiates transfer or reassignment actions to ensure all system accesses no longer required are removed and actions to ensure all system accesses required due to the individual's new position are granted immediately when personnel are reassigned or transferred to other positions. DoD defines transfer or reassignment actions as actions to ensure all system accesses no longer required are removed. DoD defines the time period as immediately.

Validation Procedures

The organization conducting the inspection/assessment obtains and examines appropriate organization security-related organizational physical and logical access documentation/logs and compares to transferred personnel documentation to ensure appropriate logical and physical access have been revoked for previous positions and granted for new positions immediately. DoD defines the time period as immediately.

Compelling Evidence

1.) SOP/TTP procedure documenting organizational physical and logical access in reference to transferred personnel. 2.) Logs that reference organizational physical and logical access in reference to transferred personnel.

The controls below (if any) were marked by NIST as being related to CCI-001528.