CCI-001531

The organization ensures that individuals requiring access to organizational information and information systems sign appropriate access agreements prior to being granted access.

Implementation Guidance

The organization being inspected/assessed will ensure all individuals have appropriate access agreements in place prior to being granted access to information and information systems. DD Form 2875 is the accepted DoD methodology of requesting and granting of access to information and information systems.

Validation Procedures

The organization conducting the inspection/assessment obtains a list of organizational individuals with active accounts and validates the existence of signed DD Form 2875 (paper or electronic) associated with a sampling of individuals selected from the list.

Compelling Evidence

1.) List of organizational individuals with active accounts and validate the existence of signed DD Form 2875 (paper or electronic) for each active account on the list.

The controls below (if any) were marked by NIST as being related to CCI-001531.