CCI-002562

The organization monitors the use of organization-defined information system components which have the potential to cause damage to the information system if used maliciously.

Implementation Guidance

The organization being inspected/assessed documents and implements a process to monitor the use of all information system components (through the use of an acceptable use agreement) which have the potential to cause damage to the information system if used maliciously. The organization must maintain an audit trail of monitoring. DoD has defined the information system components as all information system components (through the use of an acceptable use agreement).

Validation Procedures

The organization conducting the inspection/assessment obtains and examines the documented process as well as the audit trail of monitoring to ensure the organization being inspected/assessed monitors the use of all information system components (through the use of an acceptable use agreement). DoD has defined the information system components as all information system components (through the use of an acceptable use agreement).

Compelling Evidence

1.) Signed and dated user agreement. 2.) System security plan (SSP) (reference "usage" section).

The controls below (if any) were marked by NIST as being related to CCI-002562.