Navigate

CCI-004229

CCI-004229 Definition

Develop and document an organization-level; mission/business process-level; and/or system-level physical and environmental protection policy that is consistent with applicable laws, Executive Orders, directives, regulations, policies, standards, and guidelines.

Status
Type	CheckType.policy

Master Assessment Datasheet

Implementation Guidance

Determine if the [PE-01_ODP[03]; one or more of the following PARAMETER VALUES is/are selected: {organization-level; mission/business process-level; system-level}] physical and environmental protection policy is consistent with applicable laws, Executive Orders, directives, regulations, policies, standards, and guidelines.

Validation Procedures

Examine: [SELECT FROM: Physical and environmental protection policy and procedures; system security plan; privacy plan; organizational risk management strategy; other relevant documents or records]. Interview: [SELECT FROM: Organizational personnel with physical and environmental protection responsibilities; organizational personnel with information security and privacy responsibilities].

Related Controls

The controls below (if any) were marked by NIST as being related to CCI-004229.

Control	Description
PE-1	a: Develop, document, and disseminate to [one of ]: 1: [one or more of "organization-level"/"mission/business process-level"/"system-level"] physical and environmental protection policy that: (a): Addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance; and (b): Is consistent with applicable laws, executive orders, directives, regulations, policies, standards, and guidelines; and 2: Procedures to facilitate the implementation of the physical and environmental protection policy and the associated physical and environmental protection controls; b: Designate an [an official to manage the physical and environmental protection policy and procedures is defined;] to manage the development, documentation, and dissemination of the physical and environmental protection policy and procedures; and c: Review and update the current physical and environmental protection: 1: Policy [the frequency at which the current physical and environmental protection policy is reviewed and updated is defined;] and following [events that would require the current physical and environmental protection policy to be reviewed and updated are defined;] ; and 2: Procedures [the frequency at which the current physical and environmental protection procedures are reviewed and updated is defined;] and following [events that would require the physical and environmental protection procedures to be reviewed and updated are defined;].

Control

Description

PE-1

a: Develop, document, and disseminate to [one of ]:
- 1: [one or more of "organization-level"/"mission/business process-level"/"system-level"] physical and environmental protection policy that:
  - (a): Addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance; and
  - (b): Is consistent with applicable laws, executive orders, directives, regulations, policies, standards, and guidelines; and
- 2: Procedures to facilitate the implementation of the physical and environmental protection policy and the associated physical and environmental protection controls;

b: Designate an [an official to manage the physical and environmental protection policy and procedures is defined;] to manage the development, documentation, and dissemination of the physical and environmental protection policy and procedures; and

c: Review and update the current physical and environmental protection:
- 1: Policy [the frequency at which the current physical and environmental protection policy is reviewed and updated is defined;] and following [events that would require the current physical and environmental protection policy to be reviewed and updated are defined;] ; and
- 2: Procedures [the frequency at which the current physical and environmental protection procedures are reviewed and updated is defined;] and following [events that would require the physical and environmental protection procedures to be reviewed and updated are defined;].