Question 1

What evidence do auditors ask for on PE-22 Component Marking. Mark [organization-defined] indicating the impact level or classification level of the information permitted to be processed, stored, or transmitted by the hardware component?

Accepted Answer

The defined hardware components required to carry a marking, and the marking scheme used; Information types held and the impact or classification level assigned to each; Component inventory cross referenced to the marking actually applied to each item; Physical inspection record or photographs showing markings in place and legible; Procedure for re-marking when a component's permitted processing level changes.

Question 2

Can PE-22 be evidenced continuously rather than by periodic review?

Accepted Answer

This control is evidenced by people and documents, not systems. Put the document under version control with an owner and review date, and log each review as a record with reviewer and date. Do not try to automate it.

Question 3

What is the most common gap auditors find on PE-22?

Accepted Answer

Marking applied at issue and never updated when a component is repurposed to a higher or lower level

`PE-22` Component Marking. Mark [organization-defined] indicating the impact level or classification level of the information permitted to be processed, stored, or transmitted by the hardware component

system holds itEvidence a system already holds

periodic reviewEvidence produced at each review

governing documentDocuments that govern the control

First move

Common gaps auditors find

Do this for your whole sheet