ComplianceNIST 800-53 control

NIST-CM-12 Information Location

Official page ↗
Framework
NIST SP 800-53 rev5 (5.2.0)
Family
CM Configuration Management
Control
CM-12
ATT&CK techniques mitigated
2

Control statement

a. Identify and document the location of [Assignment: information] and the specific system components on which the information is processed and stored; b. Identify and document the users who have access to the system and system components where the information is processed and stored; and c. Document changes to the location (i.e., system or system components) where the information is processed and stored.

Discussion

Information location addresses the need to understand where information is being processed and stored. Information location includes identifying where specific information types and information reside in system components and how information is being processed so that information flow can be understood and adequate protection and policy management provided for such information and system components. The security category of the information is also a factor in determining the controls necessary to protect the information and the system component where the information resides (see [FIPS 199](#628d22a1-6a11-4784-bc59-5cd9497b5445) ). The location of the information and system components is also a factor in the architecture and design of the system (see [SA-4](#sa-4), [SA-8](#sa-8), [SA-17](#sa-17)).

ATT&CK mappings (CTID)

• T1005 Data from Local System • T1025 Data from Removable Media

Related

Mitigates · MITRE ATT&CK (2)

  • T1005 Data from Local System technique
  • T1025 Data from Removable Media technique

Related control · Compliance (16)

  • NIST-AC-2 Account Management NIST 800-53 control
  • NIST-AC-23 Data Mining Protection NIST 800-53 control
  • NIST-AC-3 Access Enforcement NIST 800-53 control
  • NIST-AC-4 Information Flow Enforcement NIST 800-53 control
  • NIST-AC-6 Least Privilege NIST 800-53 control
  • NIST-CM-8 System Component Inventory NIST 800-53 control
  • NIST-PM-5 System Inventory NIST 800-53 control
  • NIST-RA-2 Security Categorization NIST 800-53 control
  • NIST-SA-17 Developer Security and Privacy Architecture and Design NIST 800-53 control
  • NIST-SA-4 Acquisition Process NIST 800-53 control
  • NIST-SA-8 Security and Privacy Engineering Principles NIST 800-53 control
  • NIST-SC-16 Transmission of Security and Privacy Attributes NIST 800-53 control
  • NIST-SC-28 Protection of Information at Rest NIST 800-53 control
  • NIST-SC-4 Information in Shared System Resources NIST 800-53 control
  • NIST-SI-4 System Monitoring NIST 800-53 control
  • NIST-SI-7 Software, Firmware, and Information Integrity NIST 800-53 control

Referenced by Compliance · enhancement of (1)

  • NIST-CM-12(1) Automated Tools to Support Information Location NIST 800-53 enhancement

Referenced by Compliance · has member (1)

  • NIST-CM Configuration Management NIST 800-53 family

Referenced by Compliance · related control (7)