Applicable

(Y)es / (N)o

(C)onfidentiality

(I)ntegrity

(A)vailability

RPN

(C+I+A)

(S)atisfactory

L1

M2

H3

L1

M2

H3

L1

M2

H3

(O)ther than satisfactory +##

pe-18(1)

location of information system components  | facility site

assessment objective:

Determine if the organization:  

pe-18(1)[1]  

plans the location or site of the facility where the information system resides with regard to physical hazards;

pe-18(1)[2]  

plans the location or site of the facility where the information system resides with regard to environmental hazards;

pe-18(1)[3]  

for existing facilities, considers the physical hazards in its risk mitigation strategy; and

pe-18(1)[4]

for existing facilities, considers the environmental hazards in its risk mitigation strategy.

potential assessment methods and objects:

Examine: [select from: Physical and environmental protection policy; physical site planning documents; organizational assessment of risk, contingency plan; risk mitigation strategy documentation; other relevant documents or records].

Interview: [select from: Organizational personnel with site selection responsibilities for the facility housing the information system; organizational personnel with risk mitigation responsibilities; organizational personnel with information security responsibilities].

Test: [select from: Organizational processes for site planning].