PE-5

Requirement

Control physical access to output from [Assignment: organization-defined output devices] to prevent unauthorized individuals from obtaining the output.

Discussion

Controlling physical access to output devices includes placing output devices in locked rooms or other secured areas with keypad or card reader access controls and allowing access to authorized individuals only, placing output devices in locations that can be monitored by personnel, installing monitor or screen filters, and using headphones. Examples of output devices include monitors, printers, scanners, audio devices, facsimile machines, and copiers.

NIST 800-53A Assessment Guidance

Examine

[SELECT FROM: Physical and environmental protection policy; procedures addressing access control for display medium; facility layout of system components; actual displays from system components; list of output devices and associated outputs requiring physical access controls; physical access control logs or records for areas containing output devices and related outputs; system security plan; other relevant documents or records].

Interview

[SELECT FROM: Organizational personnel with physical access control responsibilities; organizational personnel with information security responsibilities].

Test

[SELECT FROM: Organizational processes for access control to output devices; mechanisms supporting and/or implementing access control to output devices].

ID	Assessment Objectives
PE-05	physical access to output from <PE-05_ODP output devices> is controlled to prevent unauthorized individuals from obtaining the output.

Our CMMC Overview Course simplifies CMMC. Enroll so you can make informed decisions!