Navigate

CCI-004226

CCI-004226 Definition

Defines the system media requiring downgrading.

Status
Type	CheckType.policy

Master Assessment Datasheet

Implementation Guidance

Determine if [MP-08_ODP[02]; system media requiring downgrading is defined] is identified.

Validation Procedures

Examine: [SELECT FROM: System media protection policy; procedures addressing media downgrading; system categorization documentation; list of media requiring downgrading; records of media downgrading; audit records; system security plan; other relevant documents or records]. Interview: [SELECT FROM: Organizational personnel with system media downgrading responsibilities; organizational personnel with information security responsibilities; system/network administrators]. Test: [SELECT FROM: Organizational processes for media downgrading; mechanisms supporting and/or implementing media downgrading].

Related Controls

The controls below (if any) were marked by NIST as being related to CCI-004226.

Control	Description
MP-8	a: Establish [a system media downgrading process is defined;] that includes employing downgrading mechanisms with strength and integrity commensurate with the security category or classification of the information; b: Verify that the system media downgrading process is commensurate with the security category and/or classification level of the information to be removed and the access authorizations of the potential recipients of the downgraded information; c: Identify [system media requiring downgrading is defined;] ; and d: Downgrade the identified system media using the established process.

Control

Description

MP-8

a: Establish [a system media downgrading process is defined;] that includes employing downgrading mechanisms with strength and integrity commensurate with the security category or classification of the information;

b: Verify that the system media downgrading process is commensurate with the security category and/or classification level of the information to be removed and the access authorizations of the potential recipients of the downgraded information;

c: Identify [system media requiring downgrading is defined;] ; and

d: Downgrade the identified system media using the established process.