CM-12

Requirement
1. Identify and document the location of [Assignment: organization-defined information] and the specific system components on which the information is processed and stored;
2. Identify and document the users who have access to the system and system components where the information is processed and stored; and
3. Document changes to the location (i.e., system or system components) where the information is processed and stored.

Discussion

Information location addresses the need to understand where information is being processed and stored. Information location includes identifying where specific information types and information reside in system components and how information is being processed so that information flow can be understood and adequate protection and policy management provided for such information and system components. The security category of the information is also a factor in determining the controls necessary to protect the information and the system component where the information resides (see FIPS 199). The location of the information and system components is also a factor in the architecture and design of the system (see SA-4, SA-8, SA-17).

Related NIST 800-53 ID

AC-2;AC-3;AC-4;AC-6;AC-23;CM-8;PM-5;RA-2;SA-4;SA-8;SA-17;SC-4;SC-16;SC-28;SI-4;SI-7

NIST 800-53A Assessment Guidance

Examine

[SELECT FROM: Configuration management policy; procedures addressing identification and documentation of information location; configuration management plan; system design documentation; system architecture documentation; PII inventory documentation; data mapping documentation; audit records; list of users with system and system component access; change control records; system component inventory; system security plan; privacy plan; other relevant documents or records].

Interview

[SELECT FROM: Organizational personnel with responsibilities for managing information location and user access to information; organizational personnel with responsibilities for operating, using, and/or maintaining the system; organizational personnel with information security and privacy responsibilities; system/network administrators; system developers].

Test

[SELECT FROM: Organizational processes governing information location; mechanisms enforcing policies and methods for governing information location].

ID	Assessment Objectives
CM-12a.[02]	the specific system components on which <CM-12_ODP information> is processed are identified and documented;
CM-12a.[03]	the specific system components on which <CM-12_ODP information> is stored are identified and documented;
CM-12b.[01]	the users who have access to the system and system components where <CM-12_ODP information> is processed are identified and documented;
CM-12b.[02]	the users who have access to the system and system components where <CM-12_ODP information> is stored are identified and documented;
CM-12c.[01]	changes to the location (i.e., system or system components) where <CM-12_ODP information> is processed are documented;
CM-12c.[02]	changes to the location (i.e., system or system components) where <CM-12_ODP information> is stored are documented.
CM-12a.[01]	the location of <CM-12_ODP information> is identified and documented;

Our CMMC Overview Course simplifies CMMC. Enroll so you can make informed decisions!