Navigate

CCI-002599

CCI-002599 Definition

The organization defines and identifies the information system media requiring downgrading.

Status
Type	CheckType.policy

Master Assessment Datasheet

Implementation Guidance

The organization being inspected/assessed defines, identifies, and documents the information system media requiring downgrading. DoD has determined the information system media is not appropriate to define at the Enterprise level.

Validation Procedures

The organization conducting the inspection/assessment obtains and examines the documented information system media to ensure the organization being inspected/assessed defines and identifies the information system media requiring downgrading. DoD has determined the information system media is not appropriate to define at the Enterprise level.

Compelling Evidence

1.) Signed and dated SOP or TTP, referencing section that identifies and defines the information system media requiring downgrading

Related Controls

The controls below (if any) were marked by NIST as being related to CCI-002599.

Control	Description
MP-8	The organization: a: Establishes [organization-defined information system media downgrading process] that includes employing downgrading mechanisms with [organization-defined strength and integrity]; b: Ensures that the information system media downgrading process is commensurate with the security category and/or classification level of the information to be removed and the access authorizations of the potential recipients of the downgraded information; c: Identifies [organization-defined information system media requiring downgrading]; and d: Downgrades the identified information system media using the established process.

Control

Description

MP-8

The organization:

a: Establishes [organization-defined information system media downgrading process] that includes employing downgrading mechanisms with [organization-defined strength and integrity];

b: Ensures that the information system media downgrading process is commensurate with the security category and/or classification level of the information to be removed and the access authorizations of the potential recipients of the downgraded information;

c: Identifies [organization-defined information system media requiring downgrading]; and

d: Downgrades the identified information system media using the established process.