CCI-002527

Employ organization-defined controls to ensure only organization-defined individuals or systems receive the organization-defined information, system components, or devices.

Implementation Guidance

The organization being inspected/assessed implements security safeguards defined in SC-37 (1), CCI 2525 to ensure only individuals or information systems defined in SC-37 (1), CCI 2523 receive the information, information system components, or devices defined in SC-37 (1), CCI 2526. The organization must maintain an audit trail of security safeguard implementation.

Validation Procedures

The organization conducting the inspection/assessment obtains and examines the audit trail of security safeguard implementation to ensure the organization being inspected/assessed employs security safeguards defined in SC-37 (1), CCI 2525 to ensure only individuals or information systems defined in SC-37 (1), CCI 2523 receive the information, information system components, or devices defined in SC-37 (1), CCI 2526.

Compelling Evidence

1.) Audit trail of security safeguard implementation.

The controls below (if any) were marked by NIST as being related to CCI-002527.