CCI-001635

The organization removes individuals from the facility access list when access is no longer required.

Implementation Guidance

The organization being inspected/assessed will remove personnel from the authorized access list who no longer have approved access and revoke their credentials, as identified in actions per PE-2, CCI 914. The organization must document each removal and revocation action as an audit trail.

Validation Procedures

The organization conducting the inspection/assessment obtains and examines the review and approval actions documentation to ensure that personnel no longer requiring access have been removed from the authorized access list and their credentials have been revoked.

Compelling Evidence

1.) List of personnel who have had their access removed and credentials revoked, including at least the last 90 days

The controls below (if any) were marked by NIST as being related to CCI-001635.