PE-1 PE-1 (a) (1) CCI-000905 High Moderate Low High Moderate Low High Moderate Low DoD Components are automatically compliant with this CCI because they are covered by the DoD level policy, DoDD 5200.08 and DoD 5200.08-R DoD has defined the personnel or roles as organizational personnel with physical and environmental protection responsibilities. Automatically compliant with this CCI because they are covered at the DoD level PE-1 PE-1 (a) (2) CCI-000908 High Moderate Low High Moderate Low High Moderate Low DoD Components are automatically compliant with this CCI because they are covered by the DoD level policies, DoDI 5200.08 and DoD 5200.08-R. Automatically compliant with this CCI because they are covered at the DoD level PE-1 PE-1 (a) (2) CCI-000909 High Moderate Low High Moderate Low High Moderate Low DoD Components are automatically compliant with this CCI because they are covered by the DoD level policy, DoDD 5200.08 and DoD 5200.08-R DoD has defined the personnel or roles as organizational personnel with physical and environmental protection responsibilities. Automatically compliant with this CCI because they are covered at the DoD PE-1 PE-1 (b) (1) CCI-000907 High Moderate Low High Moderate Low High Moderate Low The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level. DoD has defined the frequency reviewed annually - updated as appropriate but at least within 10 years of date of issuance. Automatically compliant with this CCI because they are covered at the DoD level
PE-1 PE-1 (b) (1) CCI-000906 High Moderate Low High Moderate Low High Moderate Low DoDI 5200.08 and DoD 5200.08-R meet the requirement for Physical and Environmental Policy and procedures. DoD Components are automatically compliant with this CCI because they are covered by the DoD level policies, DoDI 5200.08 and DoD 5200.08-R. DoD has defined the frequency reviewed annually - updated as appropriate but at least within 10 years of date of issuance. Automatically compliant with this CCI because they are covered at the DoD level PE-1 PE-1 (b) (2) CCI-000911 High Moderate Low High Moderate Low High Moderate Low The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level. DoD has defined the frequency reviewed annually - updated as appropriate. Automatically compliant with this CCI because they are covered at the DoD PE-1 PE-1 (b) (2) CCI-000910 High Moderate Low High Moderate Low High Moderate Low DoD Components are automatically compliant with this CCI because they are covered by the DoD level policies, DoDI 5200.08 and DoD 5200.08-R. DoD has defined the frequency reviewed annually - updated as appropriate. Automatically compliant with this CCI because they are covered at the DoD
PE-14 (1) PE-14 (1) CCI-000975 blank blank blank The organization conducting the inspection/assessment conducts visual inspections and interviews personnel responsible for maintaining automatic temperature and humidity controls to validate the organization is employing automatic temperature and humidity controls for the information system to prevent fluctuations potentially harmful to the information system. NIST has not allocated this AP. Therefore, this AP is not applicable. PE-14 (2) PE-14 (2) CCI-000976 blank blank blank The organization conducting the inspection/assessment conducts visual inspections and interviews personnel responsible for maintaining automatic temperature and humidity controls to validate the inspected organization is employing automatic temperature and humidity controls that provide an alarm or notification of changes potentially harmful to personnel or equipment. NIST has not allocated this AP. Therefore, this AP is not applicable.
PE-14 PE-14 (a) CCI-000971 High Moderate Low The organization conducting the inspection/assessment reviews temperature and humidity controls to validate that they are set within DoD specified guidelines. DoD has defined the acceptable levels as for commercial grade information systems: 64.4 – 80.6 degrees F; 45% – 60% Relative Humidity; Dew Point 41.9 ° – 59°F; measured at the air intake inlet of the IT equipment casing; for other systems, levels within manufacturer specifications.
PE-15 PE-15 CCI-000978 High Moderate Low The organization conducting the inspection/assessment will visually inspect master shutoff inspection documentation (e.g., inspection form, tag attached to valve). PE-15 PE-15 CCI-000979 High Moderate Low The organization conducting the inspection/assessment obtains and examines list of key personnel with knowledge of location and activation procedures for master shutoff valves and any relevant documents or records. Interview key personnel from the list to determine if identified key personnel within the organization have knowledge of the master shutoff valves. PE-15 (1) PE-15 (1) CCI-002972 High The organization conducting the inspection/assessment obtains and examines documentation identifying water detection mechanisms to ensure the organization being inspected/assessed implements automated mechanisms to detect the presence of water in the vicinity of the information system and alerts personnel or roles defined in PE-15 (1), CCI 2973. The system is not considered a HIGH level. Therefore, this AP is not applicable.
PE-15 (1) PE-15 (1) CCI-002973 High The organization conducting the inspection/assessment obtains and examines the documented personnel or roles to ensure the organization being inspected/assessed defines the personnel or roles to be alerted when automated mechanisms detect the presence of water in the vicinity of the information system. DoD has determined the personnel or roles are not appropriate to define at the Enterprise level. The system is not considered a HIGH level. Therefore, this AP is not applicable. PE-16 PE-16 CCI-000981 High Moderate Low High Moderate Low High Moderate Low The organization conducting the inspection/assessment obtains and examines records authorizing all system components entering and exiting the facility. DoD has defined the types of information system components as all system components. PE-16 PE-16 CCI-000982 High Moderate Low High Moderate Low High Moderate Low The organization conducting the inspection/assessment obtains and examines records monitoring all system components entering and exiting the facility. DoD has defined the of information system components as all system components.
PE-18 (1) PE-18 (1) CCI-002977 blank blank blank The organization conducting the inspection/assessment obtains and examines the documented rationale to ensure the organization being inspected/assessed plans the location or site of the facility where the information system resides with regard to physical and environmental hazards. NIST has not allocated this AP. Therefore, this AP is not applicable. PE-18 (1) PE-18 (1) CCI-002978 blank blank The organization conducting the inspection/assessment obtains and examines the physical and environmental risk assessment to ensure the organization being inspected/assessed considers the physical and environmental hazards in its risk mitigation strategy for existing facilities. NIST has not allocated this AP. Therefore, this AP is not applicable. PE-19 PE-19 CCI-000993 blank blank The organization conducting the inspection/assessment obtains and examines the TEMPEST countermeasures review and inspects the information system to ensure countermeasures have been implemented. NIST has not allocated this AP. Therefore, this AP is not applicable. PE-19 (1) PE-19 (1) CCI-000994 blank blank The organization conducting the inspection/assessment obtains and examines the TEMPEST countermeasures review and inspects the information system to ensure those countermeasures have been implemented. NIST has not allocated this AP. Therefore, this AP is not applicable.
PE-3 (3) PE-3 (3) CCI-000930 blank blank blank The organization conducting the inspection/assessment obtains the list of guards or alarms for physical access point to the facility where the information system resides and visually verifies a sampling of access points to ensure the appropriate guard or alarm to monitor is in place 24 hours per day, 7 days per week. NIST has not allocated this AP. Therefore, this AP is not applicable. PE-3 (4) PE-3 (4) CCI-000931 blank blank blank The organization conducting the inspection/assessment performs a sample inspection of the lockable physical casings. The objective of the reviews is to validate the organization is lockable physical casings to protect organization-defined information system components from unauthorized physical access. NIST has not allocated this AP. Therefore, this AP is not applicable. PE-3 (4) PE-3 (4) CCI-000932 blank blank The organization conducting the inspection/assessment obtains and examines the documented information system components to ensure the organization being inspected/assessed defines information system components to be protected from unauthorized physical access using lockable physical casings. DoD has determined the information system components are not appropriate to define at the Enterprise level. NIST has not allocated this AP. Therefore, this AP is not applicable.
PE-3 (5) PE-3 (5) CCI-000933 blank blank The organization conducting the inspection/assessment inspects the information system to ensure the organization being inspected/assessed employs security safeguards defined in PE-3 (5), CCI 2928 to deter and or prevent physical tampering or alteration of hardware components defined in PE-3 (5), CCI 2929 within the information system. NIST has not allocated this AP. Therefore, this AP is not applicable. PE-3 (5) PE-3 (5) CCI-002928 blank blank blank The organization conducting the inspection/assessment obtains and examines the documented security safeguards to ensure the organization being inspected/assessed defines security safeguards to detect and prevent physical tampering or alteration of organization-defined hardware components within the information system. DoD has determined the security safeguards are not appropriate to define at the Enterprise level. NIST has not allocated this AP. Therefore, this AP is not applicable.
PE-3 PE-3 (f) CCI-000924 High Moderate Low High Moderate Low High Moderate Low The organization conducting the inspection/assessment obtains and examines the records of inventory of minimally keys or any other physical token used to gain access to ensure the inventory is being conducted annually. DoD has defined the frequency as annually. DoD has defined the physical access devices as minimally keys or any other physical token used to gain access. PE-3 PE-3 (f) CCI-002925 High Moderate Low High Moderate Low High Moderate Low The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level. DoD has defined the physical access devices as minimally keys or any other physical token used to gain access. Automatically compliant with this CCI because they are covered at the DoD level PE-3 PE-3 (f) CCI-000925 High Moderate Low High Moderate Low High Moderate Low The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level. DoD has defined the frequency as annually. Automatically compliant with this CCI because they are covered at the DoD level
PE-5 (2) PE-5 (2) (b) CCI-002936 blank blank The organization conducting the inspection/assessment examines the information system to ensure the organization being inspected/assessed configures the information system to link individual identity to receipt of the output from the output device defined in PE-5 (1), CCI 2933. For information system components that have applicable STIGs or SRGs, the organization conducting the inspection/assessment evaluates the components to ensure that the organization being inspected/assessed has configured the information system in compliance with the applicable STIGs and SRGs pertaining to CCI 2936. NIST has not allocated this AP. Therefore, this AP is not applicable.
PE-5 (3) PE-5 (3) CCI-002937 blank blank The organization conducting the inspection/assessment inspects a sampling of information system components to ensure the organization being inspected/assessed marks all devices if the organizational facility contains classified information indicating the appropriate security marking of the information permitted to be output from the device. DoD has defined the information system output devices as all devices if the organizational facility contains classified information. NIST has not allocated this AP. Therefore, this AP is not applicable. PE-5 (3) PE-5 (3) CCI-002938 blank The organization inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level. DoD has defined the information system output devices as all devices if the organizational facility contains classified information. NIST has not allocated this AP. Therefore, this AP is not applicable. PE-6 (1) PE-6 (1) CCI-000942 High Moderate High Moderate High Moderate The organization conducting the inspection/assessment will observe and interview security personnel conducting monitoring activities to validate the organization is actively monitoring all physical intrusion alarms and surveillance equipment.
PE-6 (2) PE-6 (2) CCI-002945 blank blank blank The organization conducting the inspection/assessment obtains and examines the documented response actions to ensure the organization being inspected/assessed defines response actions to initiate when organization-defined classes/types of intrusions are recognized. DoD has determined the response actions are not appropriate to define at the Enterprise level. NIST has not allocated this AP. Therefore, this AP is not applicable. PE-6 (3) PE-6 (3) CCI-002946 blank blank The organization conducting the inspection/assessment obtains and examines the documentation of video surveillance a sampling of recorded video surveillance to ensure the organization being inspected/assessed employs video surveillance of operational areas defined in PE-6 (3), CCI 2947. NIST has not allocated this AP. Therefore, this AP is not applicable. PE-6 (3) PE-6 (3) CCI-002947 blank blank blank The organization conducting the inspection/assessment obtains and examines the documented operational areas to ensure the organization being inspected/assessed defines the operational areas to employ video surveillance. DoD has determined the operational areas are not appropriate to define at the Enterprise level. NIST has not allocated this AP. Therefore, this AP is not applicable.
PE-6 PE-6 (b) CCI-000940 High Moderate Low High Moderate Low High Moderate Low The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level. DoD has defined the frequency as every 30 days. Automatically compliant with this CCI because they are covered at the DoD level PE-6 PE-6 (c) CCI-000941 High Moderate Low High Moderate Low High Moderate Low The organization conducting the inspection/assessment obtains and examines documentation of physical security incidents to ensure coordination with the inspected organization's incident response capability occurred. Incident Response Plan PE-8 (1) PE-8 (1) CCI-000950 High High The organization conducting the inspection/assessment: 1. obtains documentation identifying the automated mechanism in use by the inspected organization to facilitate the maintenance and review of access records 2. Observes the use of the automated mechanism by the inspected organization The system is not considered a HIGH level. Therefore, this AP is not applicable. PE-8 PE-8 (a) CCI-000947 High Moderate Low High Moderate Low High Moderate Low The organization conducting the inspection/assessment obtains and examines visitor access records to determine if the organization is maintaining visitor access records to the facility where the information system resides for at least one year. DoD has defined the time period as at least one year.
PE-8 PE-8 (a) CCI-002952 High Moderate Low High Moderate Low High Moderate Low The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level. DoD has defined the time period as at least one year. Automatically compliant with this CCI because they are covered at the DoD level PE-8 PE-8 (b) CCI-000948 High Moderate Low High Moderate Low High Moderate Low The organization conducting the inspection/assessment obtains and examines the audit documentation of visitor access record review to ensure the inspected organization is conducting reviews every 30 days. DoD has defined the frequency as every 30 days. PE-8 PE-8 (b) CCI-000949 High Moderate Low High Moderate Low High Moderate Low The organization inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level. DoD has defined the frequency as every 30 days. Automatically compliant with this CCI because they are covered at the DoD level PE-9 PE-9 CCI-000952 High Moderate The organization conducting the inspection/assessment obtains and examines the list of protective measures. Physical inspection of power equipment and power cabling will be done to ensure identified protective measures are in place.
PE-9 (2) PE-9 (2) CCI-000955 blank blank The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level. DoD has defined the list of critical information system components as all IT Components Critical to Execution of Missions. Automatically compliant with this CCI because they are covered at the DoD level ENCLOSURE 1 – AUTHORIZED PERSONNEL ACCESS LIST Authorized Personnel Access List Personnel Name Organization