CCI-002492

The organization changes the location of organization-defined processing and/or storage at an organization-defined time frequency or at random time intervals.

Implementation Guidance

The organization being inspected/assessed documents and implements a process to change the location of the processing and/or storage defined in SC-30 (3), CCI 2489 at the time frequency defined in SC-30 (3), CCI 2490 or at random time intervals. The organization must maintain an audit trail of changes.

Validation Procedures

The organization conducting the inspection/assessment obtains and examines the documented process as well as the audit trail of changes to ensure the organization being inspected/assessed changes the location of the processing and/or storage defined in SC-30 (3), CCI 2489 at the time frequency defined in SC-30 (3), CCI 2490 or at random time intervals.

Compelling Evidence

1.) Signed and dated Backup Procedures. 2.) SLA documentation (reference 'storage location' section).

The controls below (if any) were marked by NIST as being related to CCI-002492.