PE-21 Electromagnetic Pulse Protection. Employ [organization-defined] against electromagnetic pulse damage for [organization-defined]
Electromagnetic Pulse Protection. Employ [organization-defined] against electromagnetic pulse damage for [organization-defined].
5
artefacts
0
held by a system
1
at each review
hard
to go live
Policy repository / GRC workspace
where the evidence lives
teal = a system already holds it · olive = produced at each review
system holds itEvidence a system already holds
none for this control
periodic reviewEvidence produced at each review
- Inspection records confirming bonding, grounding and enclosure integrity are maintained · Physical access / facilities
governing documentDocuments that govern the control
- Definition of the systems or components requiring electromagnetic pulse protection · Policy repository / GRC workspace
- The protective measures employed, such as surge arrest, shielded enclosures or filtered power and signal entry · Policy repository / GRC workspace
- List of locations where the protective measures are implemented · Policy repository / GRC workspace
- Design or test documentation supporting the adequacy of the measures for the assessed threat · Policy repository / GRC workspace
First move
This control is evidenced by people and documents, not systems. Put the document under version control with an owner and review date, and log each review as a record with reviewer and date. Do not try to automate it.
Common gaps auditors find
- Power entry protected while signal and network penetrations are unprotected
- Measures installed with no inspection cycle, so degraded bonding goes unnoticed
- Protection scoped to the primary site with the failover site unprotected against the same event
Do this for your whole sheet
Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.
Build my evidence sheetPE-20 Asset Monitoring and Tracking. Employ [organization-defined] to track and monitor the location and movement of [organization-defined] within [organization-defined] · PE-22 Component Marking. Mark [organization-defined] indicating the impact level or classification level of the information permitted to be processed, stored, or transmitted by the hardware component