CCI-003152

Restrict the location of information processing, information or data, and/or system services to organization-defined locations based on organization-defined requirements or conditions.

Implementation Guidance

The organization being inspected/assessed restricts the location of information processing, information/data, and/or information system services to locations defined in SA-9 (5), CCI 3153 based on requirements or conditions defined in SA-9 (5), CCI 3154.

Validation Procedures

The organization conducting the inspection/assessment obtains and examines a list of locations of information processing, information/data, and/or information system services to ensure the organization being inspected/assessed restricts the location of information processing, information/data, and/or information system services to locations defined in SA-9 (5), CCI 3153 based on requirements or conditions defined in SA-9 (5), CCI 3154.

Compelling Evidence

1.) System security plan (SSP) will define the locations of information processing, information/data, and/or information system services to organization-defined locations based on organization-defined requirements or conditions.

The controls below (if any) were marked by NIST as being related to CCI-003152.