Additional controls based on DLMs and protective markings Classification Additional Controls [P] Protected Processing facilities managed by the Responsible should [SC] Sensitive: Cabinet be segregated physically from those managed by third parties. [I4] Integrity 4 [A4] Availability 4 [SLC] Sensitive: Legal or Intruder prevention and detection systems for physical incursions, including alarms should be installed and regularly Commercial tested. [SM] Sensitive: Medical Locations of sensitive information processing facilities and [SP] Sensitive: Personal other areas should not be included on directories and phone [I3] Integrity 3 books, with special consideration given to publicly accessible directory information such as that located in lobbies, foyers [A3] Availability 3 and stairwells. Office equipment and support functions should be situated [FOUO] Official Use Only within the secure area to reduce the likelihood of information compromised. [SOUO] Sensitive [I2] Integrity 2 To the extent practicable, site locations should not give indication of the information processing activities and [A2] Availability 2 requirements transpiring in situ. Key facilities should be located to avoid or reduce general access by the public. Note: Controls begin to apply at the classifications listed and are retained at higher levels. Working in Secure ISMF Standard 38 (Secure Areas) Each Agency should enforce controls for working in secure areas and should apply such controls to all personnel or third parties working there, as well as third party activities taking place there. Suppliers and their contractors or representatives must adhere to Agency controls for working in secure areas. Business Controls The following general guidance applies regardless of the classification levels of the information assets: Each Responsible Party should implement the guidance described in (alternately refer ). Additional controls on DLMs and protective markings
Additional controls based on DLMs and protective markings Classification Additional Controls [P] Protected [SC] Sensitive: Cabinet [I4] Integrity 4 [A4] Availability 4 Processing facilities managed by the Responsible should be segregated physically from those managed by third parties. [SLC] Sensitive: Legal or Commercial [SM] Sensitive: Medical [SP] Sensitive: Personal [I3] Integrity 3 [A3] Availability 3 Intruder prevention and detection systems for physical incursions, including alarms should be installed and regularly tested. Locations of sensitive information processing facilities and other areas should not be included on directories and phone books, with special consideration given to publicly accessible directory information such as that located in lobbies, foyers and stairwells. [FOUO] Official Use Only [SOUO] Sensitive [I2] Integrity 2 [A2] Availability 2 Office equipment and support functions should be situated within the secure area to reduce the likelihood of information compromised. To the extent practicable, site locations should not give indication of the information processing activities and requirements transpiring in situ. Key facilities should be located to avoid or reduce general access by the public. Note: Controls begin to apply at the classifications listed and are retained at higher levels. Working in Secure ISMF Standard 38 (Secure Areas) Each Agency should enforce controls for working in secure areas and should apply such controls to all personnel or third parties working there, as well as third party activities taking place there. Suppliers and their contractors or representatives must adhere to Agency controls for working in secure areas. Business Controls The following general guidance applies regardless of the classification levels of the information assets: Each Responsible Party should implement the guidance described in (alternately refer ). Additional controls on DLMs and protective markings
ISMF-v3.3.docx