CCI-000983

Implementation Guidance

Determine if: - [PE-16_ODP[01]; types of system components to be authorized and controlled when entering the facility are defined] are authorized when entering the facility. - [PE-16_ODP[01]; types of system components to be authorized and controlled when entering the facility are defined] are controlled when entering the facility. - [PE-16_ODP[02]; types of system components to be authorized and controlled when exiting the facility are defined] are authorized when exiting the facility. - [PE-16_ODP[02]; types of system components to be authorized and controlled when exiting the facility are defined] are controlled when exiting the facility.

Validation Procedures

Examine: [SELECT FROM: Physical and environmental protection policy; procedures addressing the delivery and removal of system components from the facility; facility housing the system; records of items entering and exiting the facility; system security plan; other relevant documents or records]. Interview: [SELECT FROM: Organizational personnel with responsibilities for controlling system components entering and exiting the facility; organizational personnel with information security responsibilities]. Test: [SELECT FROM: Organizational process for authorizing, monitoring, and controlling system-related items entering and exiting the facility; mechanisms supporting and/or implementing, authorizing, monitoring, and controlling system-related items entering and exiting the facility].