CCI-002545

The organization defines the connection ports or input/output devices that are to be physically disabled or removed from organization-defined information systems or information system components.

Implementation Guidance

The organization being inspected/assessed defines and documents the connection ports or input/output devices that are to be physically disabled or removed from organization-defined information systems or information system components. DoD has determined the connection ports or input/output devices are not appropriate to define at the Enterprise level.

Validation Procedures

The organization conducting the inspection/assessment obtains and examines the documented connection ports or input/output devices to ensure the organization being inspected/assessed defines the connection ports or input/output devices that are to be physically disabled or removed from organization-defined information systems or information system components. DoD has determined the connection ports or input/output devices are not appropriate to define at the Enterprise level.

Compelling Evidence

1.) Signed and dated Standard Operating Procedure (SOP). 2.) Concept of Operations (CONOP). 3.) Configuration Management policy (reference "ports" section).

The controls below (if any) were marked by NIST as being related to CCI-002545.