Navigate

PE-20

PE-20: Asset Monitoring and Tracking

The organization:

a: Employs [organization-defined asset location technologies] to track and monitor the location and movement of [organization-defined assets] within [organization-defined controlled areas]; and

b: Ensures that asset location technologies are employed in accordance with applicable federal laws, Executive Orders, directives, regulations, policies, standards, and guidance.

Supplemental

Asset location technologies can help organizations ensure that critical assets such as vehicles or essential information system components remain in authorized locations. Organizations consult with the Office of the General Counsel and the Senior Agency Official for Privacy (SAOP)/Chief Privacy Officer (CPO) regarding the deployment and use of asset location technologies to address potential privacy concerns.

CIA Levels
Confidentiality	unknown
Integrity	unknown
Availability	unknown

Overlays
None

CSF Categories
DE.CM-2, DE.CM-7

Related Controls

The controls below (if any) were marked by NIST as being related to PE-20.

Control	Description
CM-8	The organization: a: Develops and documents an inventory of information system components that: 1: Accurately reflects the current information system; 2: Includes all components within the authorization boundary of the information system; 3: Is at the level of granularity deemed necessary for tracking and reporting; and 4: Includes [organization-defined information deemed necessary to achieve effective information system component accountability]; and b: Reviews and updates the information system component inventory [organization-defined frequency].

Control

Description

CM-8

The organization:

a: Develops and documents an inventory of information system components that:
- 1: Accurately reflects the current information system;
- 2: Includes all components within the authorization boundary of the information system;
- 3: Is at the level of granularity deemed necessary for tracking and reporting; and
- 4: Includes [organization-defined information deemed necessary to achieve effective information system component accountability]; and

b: Reviews and updates the information system component inventory [organization-defined frequency].

Enhancements

The controls below (if any) add on to the requirements of PE-20.

Control	Description
No controls

Related CCIs

The CCIs below are tied to PE-20.

CCI	Definition
CCI-002979	Employ organization-defined asset location technologies to track and monitor the location and movement of organization-defined assets within organization-defined controlled areas.
CCI-002980	Defines asset location technologies to track and monitor the location and movement of organization-defined assets within organization-defined controlled areas.
CCI-002981	Defines the assets within the organization-defined controlled areas which are to be tracked and monitored for their location and movement.
CCI-002982	Defines controlled areas where the location and movement of organization-defined assets are tracked and monitored.
CCI-002983	The organization ensures that asset location technologies are employed in accordance with applicable federal laws, Executive Orders, directives, regulations, policies, standards, and guidance.