Applicable

(Y)es / (N)o

(C)onfidentiality

(I)ntegrity

(A)vailability

RPN

(C+I+A)

(S)atisfactory

L1

M2

H3

L1

M2

H3

L1

M2

H3

(O)ther than satisfactory +##

sc-28

protection of information at rest

assessment objective:

Determine if:

sc-28[1]

the organization defines information at rest requiring one or more of the following:

sc-28[1][a]

confidentiality protection; and/or

sc-28[1][b]

integrity protection;

sc-28[2]

the information system protects:

sc-28[2][a]

the confidentiality of organization-defined information at rest; and/or

sc-28[2][b]

the integrity of organization-defined information at rest.

potential assessment methods and objects:

Examine: [select from: System and communications protection policy; procedures addressing protection of information at rest; information system design documentation; information system configuration settings and associated documentation; cryptographic mechanisms and associated configuration documentation; list of information at rest requiring confidentiality and integrity protections; other relevant documents or records].

Interview: [select from: System/network administrators; organizational personnel with information security responsibilities; system developer].

Test: [select from: Automated mechanisms supporting and/or implementing confidentiality and integrity protections for information at rest].