Navigate

CCI-001532

CCI-001532 Definition

The organization reviews and updates access agreements for organizational information systems in accordance with organization-defined frequency.

Status
Type	CheckType.policy

Master Assessment Datasheet

Implementation Guidance

The organization being inspected/assessed reviews/updates the access agreements annually of employees who have signed access agreements. The purpose of this review/update is to ensure access agreements are current and departed employees no longer have access agreements. The organization must maintain an audit trail of the review and update activity for review. DoD has defined the frequency as annually.

Validation Procedures

The organization conducting the inspection/assessment obtains and examines the audit trail to ensure review/update occurred annually and departed employees no longer have valid access agreements.

Compelling Evidence

1.) SOP/TTP documentation of review and update of user agreements which includes departed employees no longer have valid access agreements. 2.) Audit trail ensuring above is in compliance.

Related Controls

The controls below (if any) were marked by NIST as being related to CCI-001532.

Control	Description
PS-6	The organization: PS-6a.: Develops and documents access agreements for organizational information systems; PS-6b.: Reviews and updates the access agreements [Assignment: organization-defined frequency]; and PS-6c.: Ensures that individuals requiring access to organizational information and information systems: PS-6c.1.: Sign appropriate access agreements prior to being granted access; and PS-6c.2.: Re-sign access agreements to maintain access to organizational information systems when access agreements have been updated or [Assignment: organization-defined frequency].

Control

Description

PS-6

The organization:

PS-6a.: Develops and documents access agreements for organizational information systems;

PS-6b.: Reviews and updates the access agreements [Assignment: organization-defined frequency]; and

PS-6c.: Ensures that individuals requiring access to organizational information and information systems:
- PS-6c.1.: Sign appropriate access agreements prior to being granted access; and
- PS-6c.2.: Re-sign access agreements to maintain access to organizational information systems when access agreements have been updated or [Assignment: organization-defined frequency].