CCI-002563

Control the use of organization-defined system components which have the potential to cause damage to the system if used maliciously.

Implementation Guidance

The organization being inspected/assessed documents and implements a process to control the use of all information system components (through the use of an acceptable use agreement) which have the potential to cause damage to the information system if used maliciously. DoD has defined the information system components as all information system components (through the use of an acceptable use agreement).

Validation Procedures

The organization conducting the inspection/assessment obtains and examines the documented process to ensure the organization being inspected/assessed controls the use of all information system components (through the use of an acceptable use agreement). DoD has defined the information system components as all information system components (through the use of an acceptable use agreement).

Compelling Evidence

1.) Signed and dated user agreement. 2.) System security plan (SSP) (reference "usage" section).

The controls below (if any) were marked by NIST as being related to CCI-002563.