SC-42(1)

Requirement

Verify that the system is configured so that data or information collected by the [Assignment: organization-defined sensors] is only reported to authorized individuals or roles.

Discussion

In situations where sensors are activated by authorized individuals, it is still possible that the data or information collected by the sensors will be sent to unauthorized entities.

Title

Sensor Capability and Data | Reporting to Authorized Individuals or Roles
Family

System and Communications Protection
NIST 800-53B Baseline(s)

NIST 800-53A Assessment Guidance

Examine

[SELECT FROM: System and communications protection policy; access control policy and procedures; procedures addressing sensor capability and data collection; personally identifiable information processing policy; system design documentation; system configuration settings and associated documentation; system architecture; system audit records; system security plan; privacy plan; other relevant documents or records].

Interview

[SELECT FROM: System/network administrators; organizational personnel with information security and privacy responsibilities; system developer; organizational personnel installing, configuring, and/or maintaining the system; organizational personnel responsible for the sensor capabilities].

Test

[SELECT FROM: Mechanisms restricting the reporting of sensor information to those authorized; sensor data collection and reporting capabilities for the system].

ID	Assessment Objectives
SC-42(01)	the system is configured so that data or information collected by the <SC-42(01)_ODP sensors> is only reported to authorized individuals or roles.

Our CMMC Overview Course simplifies CMMC. Enroll so you can make informed decisions!