CCI-002378

Defines the personnel or roles to be recipients of the organization-level; mission/business process-level; and/or system-level system and communications protection policy.

Implementation Guidance

The organization being inspected/assessed defines and documents personnel or roles to be recipients of the system and communications protection policy. The personnel or roles must include at a minimum, the ISSM/ISSO. DoD has defined the personnel or roles as at a minimum, the ISSO/ISSM.

Validation Procedures

The organization conducting the inspection/assessment obtains and examines the documented personnel or roles to ensure the organization being inspected/assessed defines the personnel or roles to be recipients of the system and communications protection policy. The personnel or roles must include at a minimum, the ISSM/ISSO. DoD has defined the personnel or roles as at a minimum, the ISSO/ISSM.

Compelling Evidence

1.) Signed and dated documentation that lists all the roles and personnel who must be a recipients of the system and communication protection policy.

The controls below (if any) were marked by NIST as being related to CCI-002378.