CCI-002560

Establish usage restrictions and implementation guidance for organization-defined system components based on the potential to cause damage to the system if used maliciously.

Implementation Guidance

Determine if usage restrictions and implementation guidelines are established for [SC-43_ODP; the components for which usage restrictions and implementation guidance are to be established are defined].

Validation Procedures

Examine: [SELECT FROM: System and communications protection policy; usage restrictions; procedures addressing usage restrictions; implementation policy and procedures; authorization records; system monitoring records; system audit records; system security plan; other relevant documents or records]. Interview: [SELECT FROM: System/network administrators; organizational personnel with information security responsibilities; organizational personnel installing, configuring, and/or maintaining the system]. Test: [SELECT FROM: Organizational processes for authorizing, monitoring, and controlling the use of components with usage restrictions; mechanisms supporting and/or implementing, authorizing, monitoring, and controlling the use of components with usage restrictions].

The controls below (if any) were marked by NIST as being related to CCI-002560.