compliance controls are associated with this Policy definition 'Employ a media sanitization mechanism' (eaaae23f-92c9-4460-51cf-913feaea4d52)
| Control Domain |
Control |
Name |
MetadataId |
Category |
Title |
Owner |
Requirements |
Description |
Info |
Policy# |
| FedRAMP_High_R4 |
MA-2 |
FedRAMP_High_R4_MA-2 |
FedRAMP High MA-2 |
Maintenance |
Controlled Maintenance |
Shared |
n/a |
The organization:
a. Schedules, performs, documents, and reviews records of maintenance and repairs on information system components in accordance with manufacturer or vendor specifications and/or organizational requirements;
b. Approves and monitors all maintenance activities, whether performed on site or remotely and whether the equipment is serviced on site or removed to another location;
c. Requires that [Assignment: organization-defined personnel or roles] explicitly approve the removal of the information system or system components from organizational facilities for off-site maintenance or repairs;
d. Sanitizes equipment to remove all information from associated media prior to removal from organizational facilities for off-site maintenance or repairs;
e. Checks all potentially impacted security controls to verify that the controls are still functioning properly following maintenance or repair actions; and
f. Includes [Assignment: organization-defined maintenance-related information] in organizational maintenance records.
Supplemental Guidance: This control addresses the information security aspects of the information system maintenance program and applies to all types of maintenance to any system component (including applications) conducted by any local or nonlocal entity (e.g., in-contract, warranty, in- house, software maintenance agreement). System maintenance also includes those components not directly associated with information processing and/or data/information retention such as scanners, copiers, and printers. Information necessary for creating effective maintenance records includes, for example: (i) date and time of maintenance; (ii) name of individuals or group performing the maintenance; (iii) name of escort, if necessary; (iv) a description of the maintenance performed; and (v) information system components/equipment removed or replaced (including identification numbers, if applicable). The level of detail included in maintenance records can be informed by
the security categories of organizational information systems. Organizations consider supply chain issues associated with replacement components for information systems. Related controls: CM-3, CM-4, MA-4, MP-6, PE-16, SA-12, SI-2.
References: None. |
link |
4 |
| FedRAMP_High_R4 |
MA-3(3) |
FedRAMP_High_R4_MA-3(3) |
FedRAMP High MA-3 (3) |
Maintenance |
Prevent Unauthorized Removal |
Shared |
n/a |
The organization prevents the unauthorized removal of maintenance equipment containing organizational information by:
(a) Verifying that there is no organizational information contained on the equipment;
(b) Sanitizing or destroying the equipment;
(c) Retaining the equipment within the facility; or
(d) Obtaining an exemption from [Assignment: organization-defined personnel or roles] explicitly authorizing removal of the equipment from the facility.
Supplemental Guidance: Organizational information includes all information specifically owned by organizations and information provided to organizations in which organizations serve as information stewards. |
link |
4 |
| FedRAMP_High_R4 |
MA-5(1) |
FedRAMP_High_R4_MA-5(1) |
FedRAMP High MA-5 (1) |
Maintenance |
Individuals Without Appropriate Access |
Shared |
n/a |
The organization:
(a) Implements procedures for the use of maintenance personnel that lack appropriate security clearances or are not U.S. citizens, that include the following requirements:
(1) Maintenance personnel who do not have needed access authorizations, clearances, or formal access approvals are escorted and supervised during the performance of maintenance and diagnostic activities on the information system by approved organizational personnel who are fully cleared, have appropriate access authorizations, and are technically qualified;
(2) Prior to initiating maintenance or diagnostic activities by personnel who do not have needed access authorizations, clearances or formal access approvals, all volatile information storage components within the information system are sanitized and all nonvolatile storage media are removed or physically disconnected from the system and secured; and
(b) Develops and implements alternate security safeguards in the event an information system component cannot be sanitized, removed, or disconnected from the system.
Supplemental Guidance: This control enhancement denies individuals who lack appropriate security clearances (i.e., individuals who do not possess security clearances or possess security clearances at a lower level than required) or who are not U.S. citizens, visual and
electronic access to any classified information, Controlled Unclassified Information (CUI), or any other sensitive information contained on organizational information systems. Procedures for the use of maintenance personnel can be documented in security plans for the information systems. Related controls: MP-6, PL-2. |
link |
2 |
| FedRAMP_High_R4 |
MP-4 |
FedRAMP_High_R4_MP-4 |
FedRAMP High MP-4 |
Media Protection |
Media Storage |
Shared |
n/a |
The organization:
a. Physically controls and securely stores [Assignment: organization-defined types of digital and/or non-digital media] within [Assignment: organization-defined controlled areas]; and
b. Protects information system media until the media are destroyed or sanitized using approved equipment, techniques, and procedures.
Supplemental Guidance: Information system media includes both digital and non-digital media. Digital media includes, for example, diskettes, magnetic tapes, external/removable hard disk drives, flash drives, compact disks, and digital video disks. Non-digital media includes, for example, paper and microfilm. Physically controlling information system media includes, for example, conducting inventories, ensuring procedures are in place to allow individuals to check out and return media to the media library, and maintaining accountability for all stored media. Secure storage includes, for example, a locked drawer, desk, or cabinet, or a controlled media library. The type of media storage is commensurate with the security category and/or classification of the information residing on the media. Controlled areas are areas for which organizations provide sufficient physical and procedural safeguards to meet the requirements established for protecting information and/or information systems. For media containing information determined by organizations to be in the public domain, to be publicly releasable, or to have limited or no adverse impact on organizations or individuals if accessed by other than authorized personnel, fewer safeguards may be needed. In these situations, physical access controls provide adequate protection. Related controls: CP-6, CP-9, MP-2, MP-7, PE-3.
References: FIPS Publication 199; NIST Special Publications 800-56, 800-57, 800-111. |
link |
2 |
| FedRAMP_High_R4 |
MP-6 |
FedRAMP_High_R4_MP-6 |
FedRAMP High MP-6 |
Media Protection |
Media Sanitization |
Shared |
n/a |
The organization:
a. Sanitizes [Assignment: organization-defined information system media] prior to disposal, release out of organizational control, or release for reuse using [Assignment: organization- defined sanitization techniques and procedures] in accordance with applicable federal and organizational standards and policies; and
b. Employs sanitization mechanisms with the strength and integrity commensurate with the security category or classification of the information.
Supplemental Guidance: This control applies to all information system media, both digital and non- digital, subject to disposal or reuse, whether or not the media is considered removable. Examples include media found in scanners, copiers, printers, notebook computers, workstations, network components, and mobile devices. The sanitization process removes information from the media such that the information cannot be retrieved or reconstructed. Sanitization techniques, including clearing, purging, cryptographic erase, and destruction, prevent the disclosure of information to unauthorized individuals when such media is reused or released for disposal. Organizations determine the appropriate sanitization methods recognizing that destruction is sometimes necessary when other methods cannot be applied to media requiring sanitization. Organizations use discretion on the employment of approved sanitization techniques and procedures for media containing information deemed to be in the public domain or publicly releasable, or deemed to have no adverse impact on organizations or individuals if released for reuse or disposal. Sanitization of non-digital media includes, for example, removing a classified appendix from an otherwise unclassified document, or redacting selected sections or words from a document by obscuring the redacted sections/words in a manner equivalent in effectiveness to removing them from the document. NSA standards and policies control the sanitization process for media containing classified information. Related controls: MA-2, MA-4, RA-3, SC-4.
References: FIPS Publication 199; NIST Special Publications 800-60, 800-88; Web: http://www.nsa.gov/ia/mitigation_guidance/media_destruction_guidance/index.shtml. |
link |
2 |
| FedRAMP_High_R4 |
MP-6(1) |
FedRAMP_High_R4_MP-6(1) |
FedRAMP High MP-6 (1) |
Media Protection |
Review / Approve / Track / Document / Verify |
Shared |
n/a |
The organization reviews, approves, tracks, documents, and verifies media sanitization and disposal actions.
Supplemental Guidance: Organizations review and approve media to be sanitized to ensure compliance with records-retention policies. Tracking/documenting actions include, for example, listing personnel who reviewed and approved sanitization and disposal actions, types of media sanitized, specific files stored on the media, sanitization methods used, date and time of the sanitization actions, personnel who performed the sanitization, verification actions taken, personnel who performed the verification, and disposal action taken.
Organizations verify that the sanitization of the media was effective prior to disposal. Related control: SI-12. |
link |
2 |
| FedRAMP_High_R4 |
MP-6(2) |
FedRAMP_High_R4_MP-6(2) |
FedRAMP High MP-6 (2) |
Media Protection |
Equipment Testing |
Shared |
n/a |
The organization tests sanitization equipment and procedures [Assignment: organization-defined frequency] to verify that the intended sanitization is being achieved.
Supplemental Guidance: Testing of sanitization equipment and procedures may be conducted by qualified and authorized external entities (e.g., other federal agencies or external service providers). |
link |
2 |
| FedRAMP_Moderate_R4 |
MA-2 |
FedRAMP_Moderate_R4_MA-2 |
FedRAMP Moderate MA-2 |
Maintenance |
Controlled Maintenance |
Shared |
n/a |
The organization:
a. Schedules, performs, documents, and reviews records of maintenance and repairs on information system components in accordance with manufacturer or vendor specifications and/or organizational requirements;
b. Approves and monitors all maintenance activities, whether performed on site or remotely and whether the equipment is serviced on site or removed to another location;
c. Requires that [Assignment: organization-defined personnel or roles] explicitly approve the removal of the information system or system components from organizational facilities for off-site maintenance or repairs;
d. Sanitizes equipment to remove all information from associated media prior to removal from organizational facilities for off-site maintenance or repairs;
e. Checks all potentially impacted security controls to verify that the controls are still functioning properly following maintenance or repair actions; and
f. Includes [Assignment: organization-defined maintenance-related information] in organizational maintenance records.
Supplemental Guidance: This control addresses the information security aspects of the information system maintenance program and applies to all types of maintenance to any system component (including applications) conducted by any local or nonlocal entity (e.g., in-contract, warranty, in- house, software maintenance agreement). System maintenance also includes those components not directly associated with information processing and/or data/information retention such as scanners, copiers, and printers. Information necessary for creating effective maintenance records includes, for example: (i) date and time of maintenance; (ii) name of individuals or group performing the maintenance; (iii) name of escort, if necessary; (iv) a description of the maintenance performed; and (v) information system components/equipment removed or replaced (including identification numbers, if applicable). The level of detail included in maintenance records can be informed by
the security categories of organizational information systems. Organizations consider supply chain issues associated with replacement components for information systems. Related controls: CM-3, CM-4, MA-4, MP-6, PE-16, SA-12, SI-2.
References: None. |
link |
4 |
| FedRAMP_Moderate_R4 |
MA-3(3) |
FedRAMP_Moderate_R4_MA-3(3) |
FedRAMP Moderate MA-3 (3) |
Maintenance |
Prevent Unauthorized Removal |
Shared |
n/a |
The organization prevents the unauthorized removal of maintenance equipment containing organizational information by:
(a) Verifying that there is no organizational information contained on the equipment;
(b) Sanitizing or destroying the equipment;
(c) Retaining the equipment within the facility; or
(d) Obtaining an exemption from [Assignment: organization-defined personnel or roles] explicitly authorizing removal of the equipment from the facility.
Supplemental Guidance: Organizational information includes all information specifically owned by organizations and information provided to organizations in which organizations serve as information stewards. |
link |
4 |
| FedRAMP_Moderate_R4 |
MA-5(1) |
FedRAMP_Moderate_R4_MA-5(1) |
FedRAMP Moderate MA-5 (1) |
Maintenance |
Individuals Without Appropriate Access |
Shared |
n/a |
The organization:
(a) Implements procedures for the use of maintenance personnel that lack appropriate security clearances or are not U.S. citizens, that include the following requirements:
(1) Maintenance personnel who do not have needed access authorizations, clearances, or formal access approvals are escorted and supervised during the performance of maintenance and diagnostic activities on the information system by approved organizational personnel who are fully cleared, have appropriate access authorizations, and are technically qualified;
(2) Prior to initiating maintenance or diagnostic activities by personnel who do not have needed access authorizations, clearances or formal access approvals, all volatile information storage components within the information system are sanitized and all nonvolatile storage media are removed or physically disconnected from the system and secured; and
(b) Develops and implements alternate security safeguards in the event an information system component cannot be sanitized, removed, or disconnected from the system.
Supplemental Guidance: This control enhancement denies individuals who lack appropriate security clearances (i.e., individuals who do not possess security clearances or possess security clearances at a lower level than required) or who are not U.S. citizens, visual and
electronic access to any classified information, Controlled Unclassified Information (CUI), or any other sensitive information contained on organizational information systems. Procedures for the use of maintenance personnel can be documented in security plans for the information systems. Related controls: MP-6, PL-2. |
link |
2 |
| FedRAMP_Moderate_R4 |
MP-4 |
FedRAMP_Moderate_R4_MP-4 |
FedRAMP Moderate MP-4 |
Media Protection |
Media Storage |
Shared |
n/a |
The organization:
a. Physically controls and securely stores [Assignment: organization-defined types of digital and/or non-digital media] within [Assignment: organization-defined controlled areas]; and
b. Protects information system media until the media are destroyed or sanitized using approved equipment, techniques, and procedures.
Supplemental Guidance: Information system media includes both digital and non-digital media. Digital media includes, for example, diskettes, magnetic tapes, external/removable hard disk drives, flash drives, compact disks, and digital video disks. Non-digital media includes, for example, paper and microfilm. Physically controlling information system media includes, for example, conducting inventories, ensuring procedures are in place to allow individuals to check out and return media to the media library, and maintaining accountability for all stored media. Secure storage includes, for example, a locked drawer, desk, or cabinet, or a controlled media library. The type of media storage is commensurate with the security category and/or classification of the information residing on the media. Controlled areas are areas for which organizations provide sufficient physical and procedural safeguards to meet the requirements established for protecting information and/or information systems. For media containing information determined by organizations to be in the public domain, to be publicly releasable, or to have limited or no adverse impact on organizations or individuals if accessed by other than authorized personnel, fewer safeguards may be needed. In these situations, physical access controls provide adequate protection. Related controls: CP-6, CP-9, MP-2, MP-7, PE-3.
References: FIPS Publication 199; NIST Special Publications 800-56, 800-57, 800-111. |
link |
2 |
| FedRAMP_Moderate_R4 |
MP-6 |
FedRAMP_Moderate_R4_MP-6 |
FedRAMP Moderate MP-6 |
Media Protection |
Media Sanitization |
Shared |
n/a |
The organization:
a. Sanitizes [Assignment: organization-defined information system media] prior to disposal, release out of organizational control, or release for reuse using [Assignment: organization- defined sanitization techniques and procedures] in accordance with applicable federal and organizational standards and policies; and
b. Employs sanitization mechanisms with the strength and integrity commensurate with the security category or classification of the information.
Supplemental Guidance: This control applies to all information system media, both digital and non- digital, subject to disposal or reuse, whether or not the media is considered removable. Examples include media found in scanners, copiers, printers, notebook computers, workstations, network components, and mobile devices. The sanitization process removes information from the media such that the information cannot be retrieved or reconstructed. Sanitization techniques, including clearing, purging, cryptographic erase, and destruction, prevent the disclosure of information to unauthorized individuals when such media is reused or released for disposal. Organizations determine the appropriate sanitization methods recognizing that destruction is sometimes necessary when other methods cannot be applied to media requiring sanitization. Organizations use discretion on the employment of approved sanitization techniques and procedures for media containing information deemed to be in the public domain or publicly releasable, or deemed to have no adverse impact on organizations or individuals if released for reuse or disposal. Sanitization of non-digital media includes, for example, removing a classified appendix from an otherwise unclassified document, or redacting selected sections or words from a document by obscuring the redacted sections/words in a manner equivalent in effectiveness to removing them from the document. NSA standards and policies control the sanitization process for media containing classified information. Related controls: MA-2, MA-4, RA-3, SC-4.
References: FIPS Publication 199; NIST Special Publications 800-60, 800-88; Web: http://www.nsa.gov/ia/mitigation_guidance/media_destruction_guidance/index.shtml. |
link |
2 |
| FedRAMP_Moderate_R4 |
MP-6(2) |
FedRAMP_Moderate_R4_MP-6(2) |
FedRAMP Moderate MP-6 (2) |
Media Protection |
Equipment Testing |
Shared |
n/a |
The organization tests sanitization equipment and procedures [Assignment: organization-defined frequency] to verify that the intended sanitization is being achieved.
Supplemental Guidance: Testing of sanitization equipment and procedures may be conducted by qualified and authorized external entities (e.g., other federal agencies or external service providers). |
link |
2 |
| hipaa |
0301.09o1Organizational.123-09.o |
hipaa-0301.09o1Organizational.123-09.o |
0301.09o1Organizational.123-09.o |
03 Portable Media Security |
0301.09o1Organizational.123-09.o 09.07 Media Handling |
Shared |
n/a |
The organization, based on the data classification level, registers media (including laptops) prior to use, places reasonable restrictions on how such media are used, and provides an appropriate level of physical and logical protection (including encryption) for media containing covered information until properly destroyed or sanitized. |
|
14 |
| hipaa |
0302.09o2Organizational.1-09.o |
hipaa-0302.09o2Organizational.1-09.o |
0302.09o2Organizational.1-09.o |
03 Portable Media Security |
0302.09o2Organizational.1-09.o 09.07 Media Handling |
Shared |
n/a |
The organization protects and controls media containing sensitive information during transport outside of controlled areas. |
|
6 |
| hipaa |
0303.09o2Organizational.2-09.o |
hipaa-0303.09o2Organizational.2-09.o |
0303.09o2Organizational.2-09.o |
03 Portable Media Security |
0303.09o2Organizational.2-09.o 09.07 Media Handling |
Shared |
n/a |
Digital and non-digital media requiring restricted use, and the specific safeguards used to restrict their use are identified. |
|
6 |
| hipaa |
0304.09o3Organizational.1-09.o |
hipaa-0304.09o3Organizational.1-09.o |
0304.09o3Organizational.1-09.o |
03 Portable Media Security |
0304.09o3Organizational.1-09.o 09.07 Media Handling |
Shared |
n/a |
The organization restricts the use of writable removable media and personally-owned removable media in organizational systems. |
|
8 |
| hipaa |
0305.09q1Organizational.12-09.q |
hipaa-0305.09q1Organizational.12-09.q |
0305.09q1Organizational.12-09.q |
03 Portable Media Security |
0305.09q1Organizational.12-09.q 09.07 Media Handling |
Shared |
n/a |
Media is labeled, encrypted, and handled according to its classification. |
|
7 |
| hipaa |
0308.09q3Organizational.1-09.q |
hipaa-0308.09q3Organizational.1-09.q |
0308.09q3Organizational.1-09.q |
03 Portable Media Security |
0308.09q3Organizational.1-09.q 09.07 Media Handling |
Shared |
n/a |
Inventory and disposition records of media are maintained. |
|
3 |
| hipaa |
0403.01x1System.8-01.x |
hipaa-0403.01x1System.8-01.x |
0403.01x1System.8-01.x |
04 Mobile Device Security |
0403.01x1System.8-01.x 01.07 Mobile Computing and Teleworking |
Shared |
n/a |
The organization monitors for unauthorized connections of mobile devices. |
|
7 |
| hipaa |
0408.01y3Organizational.12-01.y |
hipaa-0408.01y3Organizational.12-01.y |
0408.01y3Organizational.12-01.y |
04 Mobile Device Security |
0408.01y3Organizational.12-01.y 01.07 Mobile Computing and Teleworking |
Shared |
n/a |
Prior to authorizing teleworking, (i) the organization provides a definition of the work permitted, standard operating hours, classification of information that may be held/stored, and the internal systems and services that the teleworker is authorized to access; (ii) suitable equipment and storage furniture for the teleworking activities, where the use of privately owned equipment not under the control of the organization is forbidden; (iii) suitable communications equipment, including methods for securing remote access; (iv) rules and guidance on family and visitor access to equipment and information; (v) hardware and software support and maintenance; (vi) procedures for back-up and business continuity; (vii) a means for teleworkers to communicate with information security personnel in case of security incidents or problems; and, (viii) audit and security monitoring. |
|
5 |
| hipaa |
0415.01y1Organizational.10-01.y |
hipaa-0415.01y1Organizational.10-01.y |
0415.01y1Organizational.10-01.y |
04 Mobile Device Security |
0415.01y1Organizational.10-01.y 01.07 Mobile Computing and Teleworking |
Shared |
n/a |
Suitable protections of the teleworking site are in place to protect against the theft of equipment and information, the unauthorized disclosure of information, and unauthorized remote access to the organization's internal systems or misuse of facilities. |
|
5 |
| hipaa |
0426.01x2System.1-01.x |
hipaa-0426.01x2System.1-01.x |
0426.01x2System.1-01.x |
04 Mobile Device Security |
0426.01x2System.1-01.x 01.07 Mobile Computing and Teleworking |
Shared |
n/a |
A centralized, mobile device management solution has been deployed to all mobile devices permitted to store, transmit, or process organizational and/or customer data, enforcing built-in detective and preventative controls. |
|
7 |
| hipaa |
0505.09m2Organizational.3-09.m |
hipaa-0505.09m2Organizational.3-09.m |
0505.09m2Organizational.3-09.m |
05 Wireless Security |
0505.09m2Organizational.3-09.m 09.06 Network Security Management |
Shared |
n/a |
Quarterly scans are performed to identify unauthorized wireless access points, and appropriate action is taken if any unauthorized access points are discovered. |
|
8 |
| hipaa |
08101.09m2Organizational.14-09.m |
hipaa-08101.09m2Organizational.14-09.m |
08101.09m2Organizational.14-09.m |
08 Network Protection |
08101.09m2Organizational.14-09.m 09.06 Network Security Management |
Shared |
n/a |
The organization uses secured and encrypted communication channels when migrating physical servers, applications, or data to virtualized servers. |
|
8 |
| hipaa |
0947.09y2Organizational.2-09.y |
hipaa-0947.09y2Organizational.2-09.y |
0947.09y2Organizational.2-09.y |
09 Transmission Protection |
0947.09y2Organizational.2-09.y 09.09 Electronic Commerce Services |
Shared |
n/a |
The organization ensures the storage of the transaction details are located outside of any publicly accessible environments (e.g., on a storage platform existing on the organization's intranet) and not retained and exposed on a storage medium directly accessible from the Internet. |
|
11 |
| hipaa |
18109.08j1Organizational.4-08.j |
hipaa-18109.08j1Organizational.4-08.j |
18109.08j1Organizational.4-08.j |
18 Physical & Environmental Security |
18109.08j1Organizational.4-08.j 08.02 Equipment Security |
Shared |
n/a |
The organization maintains a list of authorized maintenance organizations or personnel, ensures that non-escorted personnel performing maintenance on the information system have required access authorizations, and designates organizational personnel with required access authorizations and technical competence to supervise the maintenance activities of personnel who do not possess the required access authorizations. |
|
4 |
| hipaa |
18127.08l1Organizational.3-08.l |
hipaa-18127.08l1Organizational.3-08.l |
18127.08l1Organizational.3-08.l |
18 Physical & Environmental Security |
18127.08l1Organizational.3-08.l 08.02 Equipment Security |
Shared |
n/a |
Surplus equipment is stored securely while not in use, and disposed of or sanitized when no longer required. |
|
1 |
| hipaa |
18130.09p1Organizational.24-09.p |
hipaa-18130.09p1Organizational.24-09.p |
18130.09p1Organizational.24-09.p |
18 Physical & Environmental Security |
18130.09p1Organizational.24-09.p 09.07 Media Handling |
Shared |
n/a |
The organization ensures the risk of information leakage to unauthorized persons during secure media disposal is minimized. If collection and disposal services offered by other organizations are used, care is taken in selecting a suitable contractor with adequate controls and experience. |
|
1 |
| ISO27001-2013 |
A.11.2.4 |
ISO27001-2013_A.11.2.4 |
ISO 27001:2013 A.11.2.4 |
Physical And Environmental Security |
Equipment maintenance |
Shared |
n/a |
Equipment shall be correctly maintained to ensure its continued availability and integrity. |
link |
9 |
| ISO27001-2013 |
A.11.2.5 |
ISO27001-2013_A.11.2.5 |
ISO 27001:2013 A.11.2.5 |
Physical And Environmental Security |
Removal of assets |
Shared |
n/a |
Equipment, information or software shall not be taken off-site without prior authorization. |
link |
6 |
| ISO27001-2013 |
A.11.2.7 |
ISO27001-2013_A.11.2.7 |
ISO 27001:2013 A.11.2.7 |
Physical And Environmental Security |
Secure disposal or re-use of equipment |
Shared |
n/a |
All items of equipment containing storage media shall be verified to ensure that any sensitive data and licensed software has been removed or securely overwritten prior to disposal or re-use. |
link |
5 |
| ISO27001-2013 |
A.11.2.9 |
ISO27001-2013_A.11.2.9 |
ISO 27001:2013 A.11.2.9 |
Physical And Environmental Security |
Clear desk and clear screen policy |
Shared |
n/a |
A clear desk policy for papers and removable storage media and a clear screen policy for information processing facilities shall be adopted. |
link |
3 |
| ISO27001-2013 |
A.8.2.3 |
ISO27001-2013_A.8.2.3 |
ISO 27001:2013 A.8.2.3 |
Asset Management |
Handling of assets |
Shared |
n/a |
Procedures for handling assets shall be developed and implemented in accordance with the information classification scheme adopted by the organization. |
link |
26 |
| ISO27001-2013 |
A.8.3.1 |
ISO27001-2013_A.8.3.1 |
ISO 27001:2013 A.8.3.1 |
Asset Management |
Management of removable media |
Shared |
n/a |
Procedures shall be implemented for the management of removable media in accordance with the classification scheme adopted by the organization. |
link |
6 |
| ISO27001-2013 |
A.8.3.2 |
ISO27001-2013_A.8.3.2 |
ISO 27001:2013 A.8.3.2 |
Asset Management |
Disposal of media |
Shared |
n/a |
Media shall be disposed of securely and safely when no longer required, using formal procedures. |
link |
2 |
|
mp.eq.1 Clear desk |
mp.eq.1 Clear desk |
404 not found |
|
|
|
n/a |
n/a |
|
19 |
|
mp.eq.2 User session lockout |
mp.eq.2 User session lockout |
404 not found |
|
|
|
n/a |
n/a |
|
29 |
|
mp.info.6 Backups |
mp.info.6 Backups |
404 not found |
|
|
|
n/a |
n/a |
|
65 |
|
mp.si.3 Custody |
mp.si.3 Custody |
404 not found |
|
|
|
n/a |
n/a |
|
27 |
|
mp.si.4 Transport |
mp.si.4 Transport |
404 not found |
|
|
|
n/a |
n/a |
|
24 |
|
mp.si.5 Erasure and destruction |
mp.si.5 Erasure and destruction |
404 not found |
|
|
|
n/a |
n/a |
|
9 |
| NIST_SP_800-171_R2_3 |
.7.2 |
NIST_SP_800-171_R2_3.7.2 |
NIST SP 800-171 R2 3.7.2 |
Maintenance |
Provide controls on the tools, techniques, mechanisms, and personnel used to conduct system maintenance. |
Shared |
Microsoft and the customer share responsibilities for implementing this requirement. |
This requirement addresses security-related issues with maintenance tools that are not within the organizational system boundaries that process, store, or transmit CUI, but are used specifically for diagnostic and repair actions on those systems. Organizations have flexibility in determining the controls in place for maintenance tools, but can include approving, controlling, and monitoring the use of such tools. Maintenance tools are potential vehicles for transporting malicious code, either intentionally or unintentionally, into a facility and into organizational systems. Maintenance tools can include hardware, software, and firmware items, for example, hardware and software diagnostic test equipment and hardware and software packet sniffers. |
link |
4 |
| NIST_SP_800-171_R2_3 |
.7.3 |
NIST_SP_800-171_R2_3.7.3 |
NIST SP 800-171 R2 3.7.3 |
Maintenance |
Ensure equipment removed for off-site maintenance is sanitized of any CUI. |
Shared |
Microsoft and the customer share responsibilities for implementing this requirement. |
This requirement addresses the information security aspects of system maintenance that are performed off-site and applies to all types of maintenance to any system component (including applications) conducted by a local or nonlocal entity (e.g., in-contract, warranty, in- house, software maintenance agreement). [SP 800-88] provides guidance on media sanitization. |
link |
3 |
| NIST_SP_800-171_R2_3 |
.8.1 |
NIST_SP_800-171_R2_3.8.1 |
NIST SP 800-171 R2 3.8.1 |
Media Protection |
Protect (i.e., physically control and securely store) system media containing CUI, both paper and digital. |
Shared |
Microsoft is responsible for implementing this requirement. |
System media includes digital and non-digital media. Digital media includes diskettes, magnetic tapes, external and removable hard disk drives, flash drives, compact disks, and digital video disks. Non-digital media includes paper and microfilm. Protecting digital media includes limiting access to design specifications stored on compact disks or flash drives in the media library to the project leader and any individuals on the development team. Physically controlling system media includes conducting inventories, maintaining accountability for stored media, and ensuring procedures are in place to allow individuals to check out and return media to the media library. Secure storage includes a locked drawer, desk, or cabinet, or a controlled media library. Access to CUI on system media can be limited by physically controlling such media, which includes conducting inventories, ensuring procedures are in place to allow individuals to check out and return media to the media library, and maintaining accountability for all stored media. [SP 800-111] provides guidance on storage encryption technologies for end user devices. |
link |
2 |
| NIST_SP_800-171_R2_3 |
.8.2 |
NIST_SP_800-171_R2_3.8.2 |
NIST SP 800-171 R2 3.8.2 |
Media Protection |
Limit access to CUI on system media to authorized users |
Shared |
Microsoft is responsible for implementing this requirement. |
Access can be limited by physically controlling system media and secure storage areas. Physically controlling system media includes conducting inventories, ensuring procedures are in place to allow individuals to check out and return system media to the media library, and maintaining accountability for all stored media. Secure storage includes a locked drawer, desk, or cabinet, or a controlled media library. |
link |
2 |
| NIST_SP_800-171_R2_3 |
.8.3 |
NIST_SP_800-171_R2_3.8.3 |
NIST SP 800-171 R2 3.8.3 |
Media Protection |
Sanitize or destroy system media containing CUI before disposal or release for reuse. |
Shared |
Microsoft is responsible for implementing this requirement. |
This requirement applies to all system media, digital and non-digital, subject to disposal or reuse. Examples include: digital media found in workstations, network components, scanners, copiers, printers, notebook computers, and mobile devices; and non-digital media such as paper and microfilm. The sanitization process removes information from the media such that the information cannot be retrieved or reconstructed. Sanitization techniques, including clearing, purging, cryptographic erase, and destruction, prevent the disclosure of information to unauthorized individuals when such media is released for reuse or disposal. Organizations determine the appropriate sanitization methods, recognizing that destruction may be necessary when other methods cannot be applied to the media requiring sanitization. Organizations use discretion on the employment of sanitization techniques and procedures for media containing information that is in the public domain or publicly releasable or deemed to have no adverse impact on organizations or individuals if released for reuse or disposal. Sanitization of non-digital media includes destruction, removing CUI from documents, or redacting selected sections or words from a document by obscuring the redacted sections or words in a manner equivalent in effectiveness to removing the words or sections from the document. NARA policy and guidance control sanitization processes for controlled unclassified information. [SP 800-88] provides guidance on media sanitization. |
link |
2 |
| NIST_SP_800-53_R4 |
MA-2 |
NIST_SP_800-53_R4_MA-2 |
NIST SP 800-53 Rev. 4 MA-2 |
Maintenance |
Controlled Maintenance |
Shared |
n/a |
The organization:
a. Schedules, performs, documents, and reviews records of maintenance and repairs on information system components in accordance with manufacturer or vendor specifications and/or organizational requirements;
b. Approves and monitors all maintenance activities, whether performed on site or remotely and whether the equipment is serviced on site or removed to another location;
c. Requires that [Assignment: organization-defined personnel or roles] explicitly approve the removal of the information system or system components from organizational facilities for off-site maintenance or repairs;
d. Sanitizes equipment to remove all information from associated media prior to removal from organizational facilities for off-site maintenance or repairs;
e. Checks all potentially impacted security controls to verify that the controls are still functioning properly following maintenance or repair actions; and
f. Includes [Assignment: organization-defined maintenance-related information] in organizational maintenance records.
Supplemental Guidance: This control addresses the information security aspects of the information system maintenance program and applies to all types of maintenance to any system component (including applications) conducted by any local or nonlocal entity (e.g., in-contract, warranty, in- house, software maintenance agreement). System maintenance also includes those components not directly associated with information processing and/or data/information retention such as scanners, copiers, and printers. Information necessary for creating effective maintenance records includes, for example: (i) date and time of maintenance; (ii) name of individuals or group performing the maintenance; (iii) name of escort, if necessary; (iv) a description of the maintenance performed; and (v) information system components/equipment removed or replaced (including identification numbers, if applicable). The level of detail included in maintenance records can be informed by
the security categories of organizational information systems. Organizations consider supply chain issues associated with replacement components for information systems. Related controls: CM-3, CM-4, MA-4, MP-6, PE-16, SA-12, SI-2.
References: None. |
link |
4 |
| NIST_SP_800-53_R4 |
MA-3(3) |
NIST_SP_800-53_R4_MA-3(3) |
NIST SP 800-53 Rev. 4 MA-3 (3) |
Maintenance |
Prevent Unauthorized Removal |
Shared |
n/a |
The organization prevents the unauthorized removal of maintenance equipment containing organizational information by:
(a) Verifying that there is no organizational information contained on the equipment;
(b) Sanitizing or destroying the equipment;
(c) Retaining the equipment within the facility; or
(d) Obtaining an exemption from [Assignment: organization-defined personnel or roles] explicitly authorizing removal of the equipment from the facility.
Supplemental Guidance: Organizational information includes all information specifically owned by organizations and information provided to organizations in which organizations serve as information stewards. |
link |
4 |
| NIST_SP_800-53_R4 |
MA-5(1) |
NIST_SP_800-53_R4_MA-5(1) |
NIST SP 800-53 Rev. 4 MA-5 (1) |
Maintenance |
Individuals Without Appropriate Access |
Shared |
n/a |
The organization:
(a) Implements procedures for the use of maintenance personnel that lack appropriate security clearances or are not U.S. citizens, that include the following requirements:
(1) Maintenance personnel who do not have needed access authorizations, clearances, or formal access approvals are escorted and supervised during the performance of maintenance and diagnostic activities on the information system by approved organizational personnel who are fully cleared, have appropriate access authorizations, and are technically qualified;
(2) Prior to initiating maintenance or diagnostic activities by personnel who do not have needed access authorizations, clearances or formal access approvals, all volatile information storage components within the information system are sanitized and all nonvolatile storage media are removed or physically disconnected from the system and secured; and
(b) Develops and implements alternate security safeguards in the event an information system component cannot be sanitized, removed, or disconnected from the system.
Supplemental Guidance: This control enhancement denies individuals who lack appropriate security clearances (i.e., individuals who do not possess security clearances or possess security clearances at a lower level than required) or who are not U.S. citizens, visual and
electronic access to any classified information, Controlled Unclassified Information (CUI), or any other sensitive information contained on organizational information systems. Procedures for the use of maintenance personnel can be documented in security plans for the information systems. Related controls: MP-6, PL-2. |
link |
2 |
| NIST_SP_800-53_R4 |
MP-4 |
NIST_SP_800-53_R4_MP-4 |
NIST SP 800-53 Rev. 4 MP-4 |
Media Protection |
Media Storage |
Shared |
n/a |
The organization:
a. Physically controls and securely stores [Assignment: organization-defined types of digital and/or non-digital media] within [Assignment: organization-defined controlled areas]; and
b. Protects information system media until the media are destroyed or sanitized using approved equipment, techniques, and procedures.
Supplemental Guidance: Information system media includes both digital and non-digital media. Digital media includes, for example, diskettes, magnetic tapes, external/removable hard disk drives, flash drives, compact disks, and digital video disks. Non-digital media includes, for example, paper and microfilm. Physically controlling information system media includes, for example, conducting inventories, ensuring procedures are in place to allow individuals to check out and return media to the media library, and maintaining accountability for all stored media. Secure storage includes, for example, a locked drawer, desk, or cabinet, or a controlled media library. The type of media storage is commensurate with the security category and/or classification of the information residing on the media. Controlled areas are areas for which organizations provide sufficient physical and procedural safeguards to meet the requirements established for protecting information and/or information systems. For media containing information determined by organizations to be in the public domain, to be publicly releasable, or to have limited or no adverse impact on organizations or individuals if accessed by other than authorized personnel, fewer safeguards may be needed. In these situations, physical access controls provide adequate protection. Related controls: CP-6, CP-9, MP-2, MP-7, PE-3.
References: FIPS Publication 199; NIST Special Publications 800-56, 800-57, 800-111. |
link |
2 |
| NIST_SP_800-53_R4 |
MP-6 |
NIST_SP_800-53_R4_MP-6 |
NIST SP 800-53 Rev. 4 MP-6 |
Media Protection |
Media Sanitization |
Shared |
n/a |
The organization:
a. Sanitizes [Assignment: organization-defined information system media] prior to disposal, release out of organizational control, or release for reuse using [Assignment: organization- defined sanitization techniques and procedures] in accordance with applicable federal and organizational standards and policies; and
b. Employs sanitization mechanisms with the strength and integrity commensurate with the security category or classification of the information.
Supplemental Guidance: This control applies to all information system media, both digital and non- digital, subject to disposal or reuse, whether or not the media is considered removable. Examples include media found in scanners, copiers, printers, notebook computers, workstations, network components, and mobile devices. The sanitization process removes information from the media such that the information cannot be retrieved or reconstructed. Sanitization techniques, including clearing, purging, cryptographic erase, and destruction, prevent the disclosure of information to unauthorized individuals when such media is reused or released for disposal. Organizations determine the appropriate sanitization methods recognizing that destruction is sometimes necessary when other methods cannot be applied to media requiring sanitization. Organizations use discretion on the employment of approved sanitization techniques and procedures for media containing information deemed to be in the public domain or publicly releasable, or deemed to have no adverse impact on organizations or individuals if released for reuse or disposal. Sanitization of non-digital media includes, for example, removing a classified appendix from an otherwise unclassified document, or redacting selected sections or words from a document by obscuring the redacted sections/words in a manner equivalent in effectiveness to removing them from the document. NSA standards and policies control the sanitization process for media containing classified information. Related controls: MA-2, MA-4, RA-3, SC-4.
References: FIPS Publication 199; NIST Special Publications 800-60, 800-88; Web: http://www.nsa.gov/ia/mitigation_guidance/media_destruction_guidance/index.shtml. |
link |
2 |
| NIST_SP_800-53_R4 |
MP-6(1) |
NIST_SP_800-53_R4_MP-6(1) |
NIST SP 800-53 Rev. 4 MP-6 (1) |
Media Protection |
Review / Approve / Track / Document / Verify |
Shared |
n/a |
The organization reviews, approves, tracks, documents, and verifies media sanitization and disposal actions.
Supplemental Guidance: Organizations review and approve media to be sanitized to ensure compliance with records-retention policies. Tracking/documenting actions include, for example, listing personnel who reviewed and approved sanitization and disposal actions, types of media sanitized, specific files stored on the media, sanitization methods used, date and time of the sanitization actions, personnel who performed the sanitization, verification actions taken, personnel who performed the verification, and disposal action taken.
Organizations verify that the sanitization of the media was effective prior to disposal. Related control: SI-12. |
link |
2 |
| NIST_SP_800-53_R4 |
MP-6(2) |
NIST_SP_800-53_R4_MP-6(2) |
NIST SP 800-53 Rev. 4 MP-6 (2) |
Media Protection |
Equipment Testing |
Shared |
n/a |
The organization tests sanitization equipment and procedures [Assignment: organization-defined frequency] to verify that the intended sanitization is being achieved.
Supplemental Guidance: Testing of sanitization equipment and procedures may be conducted by qualified and authorized external entities (e.g., other federal agencies or external service providers). |
link |
2 |
| NIST_SP_800-53_R5 |
MA-2 |
NIST_SP_800-53_R5_MA-2 |
NIST SP 800-53 Rev. 5 MA-2 |
Maintenance |
Controlled Maintenance |
Shared |
n/a |
a. Schedule, document, and review records of maintenance, repair, and replacement on system components in accordance with manufacturer or vendor specifications and/or organizational requirements;
b. Approve and monitor all maintenance activities, whether performed on site or remotely and whether the system or system components are serviced on site or removed to another location;
c. Require that [Assignment: organization-defined personnel or roles] explicitly approve the removal of the system or system components from organizational facilities for off-site maintenance, repair, or replacement;
d. Sanitize equipment to remove the following information from associated media prior to removal from organizational facilities for off-site maintenance, repair, or replacement: [Assignment: organization-defined information];
e. Check all potentially impacted controls to verify that the controls are still functioning properly following maintenance, repair, or replacement actions; and
f. Include the following information in organizational maintenance records: [Assignment: organization-defined information]. |
link |
4 |
| NIST_SP_800-53_R5 |
MA-3(3) |
NIST_SP_800-53_R5_MA-3(3) |
NIST SP 800-53 Rev. 5 MA-3 (3) |
Maintenance |
Prevent Unauthorized Removal |
Shared |
n/a |
Prevent the removal of maintenance equipment containing organizational information by:
(a) Verifying that there is no organizational information contained on the equipment;
(b) Sanitizing or destroying the equipment;
(c) Retaining the equipment within the facility; or
(d) Obtaining an exemption from [Assignment: organization-defined personnel or roles] explicitly authorizing removal of the equipment from the facility. |
link |
4 |
| NIST_SP_800-53_R5 |
MA-5(1) |
NIST_SP_800-53_R5_MA-5(1) |
NIST SP 800-53 Rev. 5 MA-5 (1) |
Maintenance |
Individuals Without Appropriate Access |
Shared |
n/a |
(a) Implement procedures for the use of maintenance personnel that lack appropriate security clearances or are not U.S. citizens, that include the following requirements:
(1) Maintenance personnel who do not have needed access authorizations, clearances, or formal access approvals are escorted and supervised during the performance of maintenance and diagnostic activities on the system by approved organizational personnel who are fully cleared, have appropriate access authorizations, and are technically qualified; and
(2) Prior to initiating maintenance or diagnostic activities by personnel who do not have needed access authorizations, clearances or formal access approvals, all volatile information storage components within the system are sanitized and all nonvolatile storage media are removed or physically disconnected from the system and secured; and
(b) Develop and implement [Assignment: organization-defined alternate controls] in the event a system component cannot be sanitized, removed, or disconnected from the system. |
link |
2 |
| NIST_SP_800-53_R5 |
MP-4 |
NIST_SP_800-53_R5_MP-4 |
NIST SP 800-53 Rev. 5 MP-4 |
Media Protection |
Media Storage |
Shared |
n/a |
a. Physically control and securely store [Assignment: organization-defined types of digital and/or non-digital media] within [Assignment: organization-defined controlled areas]; and
b. Protect system media types defined in MP-4a until the media are destroyed or sanitized using approved equipment, techniques, and procedures. |
link |
2 |
| NIST_SP_800-53_R5 |
MP-6 |
NIST_SP_800-53_R5_MP-6 |
NIST SP 800-53 Rev. 5 MP-6 |
Media Protection |
Media Sanitization |
Shared |
n/a |
a. Sanitize [Assignment: organization-defined system media] prior to disposal, release out of organizational control, or release for reuse using [Assignment: organization-defined sanitization techniques and procedures]; and
b. Employ sanitization mechanisms with the strength and integrity commensurate with the security category or classification of the information. |
link |
2 |
| NIST_SP_800-53_R5 |
MP-6(1) |
NIST_SP_800-53_R5_MP-6(1) |
NIST SP 800-53 Rev. 5 MP-6 (1) |
Media Protection |
Review, Approve, Track, Document, and Verify |
Shared |
n/a |
Review, approve, track, document, and verify media sanitization and disposal actions. |
link |
2 |
| NIST_SP_800-53_R5 |
MP-6(2) |
NIST_SP_800-53_R5_MP-6(2) |
NIST SP 800-53 Rev. 5 MP-6 (2) |
Media Protection |
Equipment Testing |
Shared |
n/a |
Test sanitization equipment and procedures [Assignment: organization-defined frequency] to ensure that the intended sanitization is being achieved. |
link |
2 |
|
op.exp.4 Security maintenance and updates |
op.exp.4 Security maintenance and updates |
404 not found |
|
|
|
n/a |
n/a |
|
78 |
|
org.4 Authorization process |
org.4 Authorization process |
404 not found |
|
|
|
n/a |
n/a |
|
127 |
| PCI_DSS_v4.0 |
9.4.6 |
PCI_DSS_v4.0_9.4.6 |
PCI DSS v4.0 9.4.6 |
Requirement 09: Restrict Physical Access to Cardholder Data |
Media with cardholder data is securely stored, accessed, distributed, and destroyed |
Shared |
n/a |
Hard-copy materials with cardholder data are destroyed when no longer needed for business or legal reasons, as follows:
• Materials are cross-cut shredded, incinerated, or pulped so that cardholder data cannot be reconstructed.
• Materials are stored in secure storage containers prior to destruction. |
link |
4 |
| PCI_DSS_v4.0 |
9.4.7 |
PCI_DSS_v4.0_9.4.7 |
PCI DSS v4.0 9.4.7 |
Requirement 09: Restrict Physical Access to Cardholder Data |
Media with cardholder data is securely stored, accessed, distributed, and destroyed |
Shared |
n/a |
Electronic media with cardholder data is destroyed when no longer needed for business or legal reasons via one of the following:
• The electronic media is destroyed.
• The cardholder data is rendered unrecoverable so that it cannot be reconstructed. |
link |
4 |
| SOC_2 |
CC6.5 |
SOC_2_CC6.5 |
SOC 2 Type 2 CC6.5 |
Logical and Physical Access Controls |
Logical and physical protections over physical assets |
Shared |
The customer is responsible for implementing this recommendation. |
• Identifies Data and Software for Disposal — Procedures are in place to identify data and software stored on equipment to be disposed and to render such data and
software unreadable.
• Removes Data and Software From Entity Control — Procedures are in place to remove data and software stored on equipment to be removed from the physical control of the entity and to render such data and software unreadable |
|
2 |
| SOC_2 |
CC6.7 |
SOC_2_CC6.7 |
SOC 2 Type 2 CC6.7 |
Logical and Physical Access Controls |
Restrict the movement of information to authorized users |
Shared |
The customer is responsible for implementing this recommendation. |
• Restricts the Ability to Perform Transmission — Data loss prevention processes and
technologies are used to restrict ability to authorize and execute transmission,
movement, and removal of information.
• Uses Encryption Technologies or Secure Communication Channels to Protect Data
— Encryption technologies or secured communication channels are used to protect
transmission of data and other communications beyond connectivity access points.
• Protects Removal Media — Encryption technologies and physical asset protections
are used for removable media (such as USB drives and backup tapes), as appropriate.
• Protects Mobile Devices — Processes are in place to protect mobile devices (such
as laptops, smart phones, and tablets) that serve as information assets |
|
30 |