CCI-002560

The organization establishes usage restrictions and implementation guidance for organization-defined information system components based on the potential to cause damage to the information system if used maliciously.

Implementation Guidance

The organization being inspected/assessed develops and implements usage restrictions and implementation guidance for all information system components (through the use of an acceptable use agreement). DoD has defined the information system components as all information system components (through the use of an acceptable use agreement).

Validation Procedures

The organization conducting the inspection/assessment obtains and examines implementation guidance and usage restrictions and verifies that the organization has implemented them for all information system components (through the use of an acceptable use agreement). DoD has defined the information system components as all information system components (through the use of an acceptable use agreement).

Compelling Evidence

1.) Signed and dated service level agreements (SLA). 2.) Signed and dated user agreement. 3.) System security plan (SSP) (reference "usage" section).

The controls below (if any) were marked by NIST as being related to CCI-002560.