Question 1

What evidence do auditors ask for on CM-12 Information Location. Identify and document the location of [organization-defined] and the specific system components on which the information is processed and stored; Identify and document the users who have access to the system and?

Accepted Answer

Documented location of the defined information, naming the specific system components that process and store it; List of users with access to each component holding that information; Data mapping or inventory documentation, including personally identifiable information where held; Change records showing the location documentation was updated when components changed; Evidence the documented location was verified against the live estate rather than asserted.

Question 2

Can CM-12 be evidenced continuously rather than by periodic review?

Accepted Answer

Mostly documents and reviews. Pull the 1 system-held artefact from your Cloud console / configuration management on a schedule; put the documents under version control with an owner and review date, and log each review as a dated record with a named reviewer.

Question 3

What is the most common gap auditors find on CM-12?

Accepted Answer

Primary store documented while backups, caches, log stores and analytics copies are not

`CM-12` Information Location. Identify and document the location of [organization-defined] and the specific system components on which the information is processed and stored; Identify and document the users who have access to the system and

system holds itEvidence a system already holds

periodic reviewEvidence produced at each review

governing documentDocuments that govern the control

First move

Common gaps auditors find

Do this for your whole sheet