SC-28(2)

Requirement

Remove the following information from online storage and store offline in a secure location: [Assignment: organization-defined information].

Discussion

Removing organizational information from online storage to offline storage eliminates the possibility of individuals gaining unauthorized access to the information through a network. Therefore, organizations may choose to move information to offline storage in lieu of protecting such information in online storage.

NIST 800-53A Assessment Guidance

Examine

[SELECT FROM: System and communications protection policy; procedures addressing the protection of information at rest; system design documentation; system configuration settings and associated documentation; cryptographic mechanisms and associated configuration documentation; offline storage locations for information at rest; system audit records; system security plan; other relevant documents or records].

Interview

[SELECT FROM: System/network administrators; organizational personnel with information security responsibilities].

Test

[SELECT FROM: Mechanisms supporting and/or implementing the removal of information from online storage; mechanisms supporting and/or implementing storage of information offline].

ID	Assessment Objectives
SC-28(02)[01]	<SC-28(02)_ODP information> is removed from online storage;
SC-28(02)[02]	<SC-28(02)_ODP information> is stored offline in a secure location.

Our CMMC Overview Course simplifies CMMC. Enroll so you can make informed decisions!