PE-20 Asset Monitoring and Tracking. Employ [organization-defined] to track and monitor the location and movement of [organization-defined] within [organization-defined]
Asset Monitoring and Tracking. Employ [organization-defined] to track and monitor the location and movement of [organization-defined] within [organization-defined].
5
artefacts
1
held by a system
1
at each review
hard
to go live
Policy repository / GRC workspace
where the evidence lives
teal = a system already holds it · olive = produced at each review
system holds itEvidence a system already holds
- Tracking and monitoring records showing asset location and movement over the period · Physical access / facilities
periodic reviewEvidence produced at each review
- Alerting evidence when an asset left a defined area or stopped reporting · Physical access / facilities
governing documentDocuments that govern the control
- The defined assets requiring location tracking and the defined areas within which they are tracked · Policy repository / GRC workspace
- The asset location technology employed and its coverage across those areas · Policy repository / GRC workspace
- Handling rules for the location data itself where it can reveal individual movement · Policy repository / GRC workspace
First move
Mostly documents and reviews. Pull the 1 system-held artefact from your Physical access / facilities on a schedule; put the documents under version control with an owner and review date, and log each review as a dated record with a named reviewer.
Common gaps auditors find
- Tracking technology deployed with no alert on absence, so a missing asset is discovered at the next stocktake
- Defined areas never specified, leaving no boundary that movement can be assessed against
- Location data retained and accessed with no privacy consideration despite tracking staff by proxy
Do this for your whole sheet
Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.
Build my evidence sheetPE-19 Information Leakage. Protect the system from information leakage due to electromagnetic signals emanations · PE-21 Electromagnetic Pulse Protection. Employ [organization-defined] against electromagnetic pulse damage for [organization-defined]