Applicable

(Y)es / (N)o

(C)onfidentiality

(I)ntegrity

(A)vailability

RPN

(C+I+A)

(S)atisfactory

L1

M2

H3

L1

M2

H3

L1

M2

H3

(O)ther than satisfactory +##

mp-8(3)

media downgrading  | controlled unclassified information

assessment objective:

Determine if the organization:  

mp-8(3)[1]

defines Controlled Unclassified Information (CUI) contained on information system media that requires downgrading prior to public release; and

mp-8(3)[2]

downgrades information system media containing organization-defined CUI prior to public release in accordance with applicable federal and organizational standards and policies.

potential assessment methods and objects:

Examine: [select from: Information system media protection policy;  access authorization policy; procedures addressing downgrading of media containing CUI; applicable federal and organizational standards and policies regarding protection of CUI; media downgrading records; other relevant documents or records].

Interview: [select from: Organizational personnel with information system media downgrading responsibilities; organizational personnel with information security responsibilities].

Test: [select from: Organizational processes for media downgrading; automated mechanisms supporting and/or implementing media downgrading].