Navigate

CCI-004854

CCI-004854 Definition

Develop and document system and communications protection procedures to facilitate the implementation of the system and communications protection policy and associated system and communications protection controls.

Status
Type	CheckType.policy

Master Assessment Datasheet

Implementation Guidance

Determine if: - system and communications protection procedures to facilitate the implementation of the system and communications protection policy and associated system and communications protection controls are developed and documented. - the system and communications protection procedures are disseminated to [SC-01_ODP[02]; personnel or roles to whom the system and communications protection procedures are to be disseminated is/are defined].

Validation Procedures

Examine: [SELECT FROM: System and communications protection policy; system and communications protection procedures; system security plan; privacy plan; risk management strategy documentation; audit findings; other relevant documents or records]. Interview: [SELECT FROM: Organizational personnel with system and communications protection responsibilities; organizational personnel with information security and privacy responsibilities].

Related Controls

The controls below (if any) were marked by NIST as being related to CCI-004854.

Control	Description
SC-1	a: Develop, document, and disseminate to [one of ]: 1: [one or more of "organization-level"/"mission/business-process-level"/"system-level"] system and communications protection policy that: (a): Addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance; and (b): Is consistent with applicable laws, executive orders, directives, regulations, policies, standards, and guidelines; and 2: Procedures to facilitate the implementation of the system and communications protection policy and the associated system and communications protection controls; b: Designate an [an official to manage the system and communications protection policy and procedures is defined;] to manage the development, documentation, and dissemination of the system and communications protection policy and procedures; and c: Review and update the current system and communications protection: 1: Policy [the frequency at which the current system and communications protection policy is reviewed and updated is defined;] and following [events that would require the current system and communications protection policy to be reviewed and updated are defined;] ; and 2: Procedures [the frequency at which the current system and communications protection procedures are reviewed and updated is defined;] and following [events that would require the system and communications protection procedures to be reviewed and updated are defined;].

Control

Description

SC-1

a: Develop, document, and disseminate to [one of ]:
- 1: [one or more of "organization-level"/"mission/business-process-level"/"system-level"] system and communications protection policy that:
  - (a): Addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance; and
  - (b): Is consistent with applicable laws, executive orders, directives, regulations, policies, standards, and guidelines; and
- 2: Procedures to facilitate the implementation of the system and communications protection policy and the associated system and communications protection controls;

b: Designate an [an official to manage the system and communications protection policy and procedures is defined;] to manage the development, documentation, and dissemination of the system and communications protection policy and procedures; and

c: Review and update the current system and communications protection:
- 1: Policy [the frequency at which the current system and communications protection policy is reviewed and updated is defined;] and following [events that would require the current system and communications protection policy to be reviewed and updated are defined;] ; and
- 2: Procedures [the frequency at which the current system and communications protection procedures are reviewed and updated is defined;] and following [events that would require the system and communications protection procedures to be reviewed and updated are defined;].