CCI-003063

Implementation Guidance

The organization being inspected/assessed documents and implements a process to protect the security plan from unauthorized disclosure.

Validation Procedures

The organization conducting the inspection/assessment obtains and examines the documented process to ensure the organization being inspected/assessed protects the security plan from unauthorized disclosure.

Compelling Evidence

1.) Up-to-date list of organizational personnel or roles who are authorized access to the security plan. 2.) Documented procedures/sharing/dissemination protections that limit access to the security plan to those personnel/roles that are authorized access and mechanisms to report inadvertent disclosure of the system security plan (SSP) to unauthorized personnel.