CCI-004224

Verify that the system media downgrading process is commensurate with the access authorizations of the potential recipients of the downgraded information.

Implementation Guidance

Determine if: - there is verification that the system media downgrading process is commensurate with the security category and/or classification level of the information to be removed. - there is verification that the system media downgrading process is commensurate with the access authorizations of the potential recipients of the downgraded information.

Validation Procedures

Examine: [SELECT FROM: System media protection policy; procedures addressing media downgrading; system categorization documentation; list of media requiring downgrading; records of media downgrading; audit records; system security plan; other relevant documents or records]. Interview: [SELECT FROM: Organizational personnel with system media downgrading responsibilities; organizational personnel with information security responsibilities; system/network administrators]. Test: [SELECT FROM: Organizational processes for media downgrading; mechanisms supporting and/or implementing media downgrading].

The controls below (if any) were marked by NIST as being related to CCI-004224.