CCI-003041

The organization requires third-party providers to notify organization-defined personnel or roles of any personnel transfers or terminations of third-party personnel who possess organizational credentials and/or badges, or who have information system privileges within an organization-defined time period.

Implementation Guidance

The organization being inspected/assessed documents and implements a process to require third-party providers to notify at a minimum, the ISSO and personnel responsible for transferring credentials of any personnel transfers or terminations of third-party personnel who possess organizational credentials and/or badges, or who have information system privileges immediately. DoD has defined the personnel or roles as at a minimum, the ISSO and personnel responsible for transferring credentials. DoD has defined the time period as immediately.

Validation Procedures

The organization conducting the inspection/assessment obtains and examines the documented process to ensure the organization being inspected/assessed requires third-party providers to notify at a minimum, the ISSO and personnel responsible for transferring credentials of any personnel transfers or terminations of third-party personnel who possess organizational credentials and/or badges, or who have information system privileges immediately. DoD has defined the personnel or roles as at a minimum, the ISSO and personnel responsible for transferring credentials. DoD has defined the time period as immediately.

Compelling Evidence

1.) Service Level Agreements.

The controls below (if any) were marked by NIST as being related to CCI-003041.