Navigate

CCI-001531

CCI-001531 Definition

The organization ensures that individuals requiring access to organizational information and information systems sign appropriate access agreements prior to being granted access.

Status
Type	CheckType.policy

Master Assessment Datasheet

Implementation Guidance

The organization being inspected/assessed will ensure all individuals have appropriate access agreements in place prior to being granted access to information and information systems. DD Form 2875 is the accepted DoD methodology of requesting and granting of access to information and information systems.

Validation Procedures

The organization conducting the inspection/assessment obtains a list of organizational individuals with active accounts and validates the existence of signed DD Form 2875 (paper or electronic) associated with a sampling of individuals selected from the list.

Compelling Evidence

1.) List of organizational individuals with active accounts and validate the existence of signed DD Form 2875 (paper or electronic) for each active account on the list.

Related Controls

The controls below (if any) were marked by NIST as being related to CCI-001531.

Control	Description
PS-6	The organization: PS-6a.: Develops and documents access agreements for organizational information systems; PS-6b.: Reviews and updates the access agreements [Assignment: organization-defined frequency]; and PS-6c.: Ensures that individuals requiring access to organizational information and information systems: PS-6c.1.: Sign appropriate access agreements prior to being granted access; and PS-6c.2.: Re-sign access agreements to maintain access to organizational information systems when access agreements have been updated or [Assignment: organization-defined frequency].

Control

Description

PS-6

The organization:

PS-6a.: Develops and documents access agreements for organizational information systems;

PS-6b.: Reviews and updates the access agreements [Assignment: organization-defined frequency]; and

PS-6c.: Ensures that individuals requiring access to organizational information and information systems:
- PS-6c.1.: Sign appropriate access agreements prior to being granted access; and
- PS-6c.2.: Re-sign access agreements to maintain access to organizational information systems when access agreements have been updated or [Assignment: organization-defined frequency].