PM-17 Protecting Controlled Unclassified Information on External Systems. Establish policy and procedures to ensure that requirements for the protection of controlled unclassified information that is processed, stored or transmitted on external systems, are implemented in
Protecting Controlled Unclassified Information on External Systems. Establish policy and procedures to ensure that requirements for the protection of controlled unclassified information that is processed, stored or trans.
system holds itEvidence a system already holds
none for this control
periodic reviewEvidence produced at each review
- Evidence the requirements are implemented, such as assessment results or attestations from the external party · Document repository
governing documentDocuments that govern the control
- Policy and procedures for protecting controlled unclassified information processed, stored or transmitted on external systems · Policy repository / GRC workspace
- Identification of the external systems that handle controlled unclassified information · Document repository
- Agreements or contract clauses imposing the protection requirements on those external systems · Vendor register / contract repository
- Review and update records for the policy and procedures against the defined frequency · Policy repository / GRC workspace
First move
Common gaps auditors find
- Requirements imposed on prime contractors with nothing flowing down to subcontractors handling the same information
- External systems inventory incomplete, missing collaboration and file transfer services adopted by teams
- Attestation accepted at onboarding with no ongoing verification that protection continues
Do this for your whole sheet
Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.
Build my evidence sheetPM-16 Threat Awareness Program. Implement a threat awareness program that includes a cross-organization information-sharing capability for threat intelligence · PM-18 Privacy Program Plan. Develop and disseminate an organization-wide privacy program plan that provides an overview of the agency's privacy program, and: Includes a description of the structure of the privacy program and the resources