Classification Guides Must be Available for Programs and Systems for an Organization or Site

Associated with IA controls: PESP-1, ECAN-1

SV-42467r2_rule Classification Guides Must be Available for Programs and Systems for an Organization or Site

Vulnerability discussion

Failure to have proper classification guidance available for can result in the misclassification of information and ultimatley lead to the loss or compromise of classified or sensitive information.

Check content

Check to ensure the site has all Classification Guides for the systems and programs they are responsible for and/or which are applicable to their operations. Further, such classification guides and training on the use of them should be made available to employees working with the equipment or systems to which they apply. At a minimum if a site has SIPRNet connections they should have a copy of the SIPRNet Security Classification Guide. TACTICAL ENVIRONMENT: The check is applicable for fixed (established) tactical processing environments where procedural documents (SOPs) should be in place. Not applicable to a field/mobile environ

Fix text

Ensure the site has all Classification Guides for the programs and systems they are responsible for and/or which are applicable to their operations. Further, such classification guides and training on the use of them should be made available to employees working with the equipment or systems to which they apply. At a minimum if a site has SIPRNet connections they should have a copy of the SIPRNet Security Classification Guide.

Pro Tips

Lavender hyperlinks in small type off to the right (of CSS class id, if you view the page source) point to globally unique URIs for each document and item. Copy the link location and paste anywhere you need to talk unambiguously about these things.

You can obtain data about documents and items in other formats. Simply provide an HTTP header Accept: text/turtle or Accept: application/rdf+xml.