CCI-000072

Implementation Guidance

The organization being inspected/assessed implements and documents a process to ensure that users protect information about remote access mechanisms from unauthorized use and disclosure.

Validation Procedures

The organization conducting the inspection/assessment obtains and examines the documented process to ensure that the organization being inspected/assessed ensures that users protect information about remote access mechanisms from unauthorized use and disclosure.

Compelling Evidence

1.) Signed and dated access control policy. 2.) Signed and dated system security plan (SSP). 3.) Signed and dated privileged user agreement, which defines a process of how the site ensures that users protect information about remote access mechanisms from unauthorized use and disclosure.