c. Coordinate results of reviews and investigations with the organizational incident response capability. Visitor Access Records Visitor Access Records The DOC requires the OUs to: a. Maintain visitor access records to the facility PE-8 X X X where the information system resides for at least one year; and b. Review visitor access records at annually. Planning (PL) Security Baselines Control Control Name/Requirement Number Low High System Security Plan System Security Plan Risk Management Framework PL-2 to CITR-019: X X X (RMF) for control details. Rules of Behavior of Behavior The DOC requires the OUs to ensure written acknowledgement of CITR-022: Access and Use and/or an OU-specific equivalent policy prior Policy to granting access to any non-public IT systems, networks, or resources. This may be accomplished by providing employees with a copy of the policy and PL-4 X X X obtaining a written acknowledgement that they have read and understood the policy, or by developing a separate access and use form that describes this policy, to be signed by an employee or associate prior to that individual being provided access to IT systems/network/resources. Social Media And Networking Restrictions Access and Use Policy PL-4.1 Refer to CITR-022: and the X X DOC Social Media Policy for control details. Information Security Architecture Information Security Architecture The DOC requires the OUs to: a. Develop an information security architecture for PL-8 X X the information system that: 1. Describe the overall philosophy, requirements, and approach to be taken with regard to protecting the
c. Coordinate results of reviews and investigations with the organizational incident response capability. Visitor Access Records PE-8 Visitor Access Records The DOC requires the OUs to: a. Maintain visitor access records to the facility where the information system resides for at least one year; and b. Review visitor access records at annually. X X X Planning (PL) Control Number Control Name/Requirement Security Baselines Low High System Security Plan PL-2 System Security Plan to CITR-019: Risk Management Framework (RMF) for control details. X X X Rules of Behavior PL-4 of Behavior The DOC requires the OUs to ensure written acknowledgement of CITR-022: Access and Use Policy and/or an OU-specific equivalent policy prior to granting access to any non-public IT systems, networks, or resources. This may be accomplished by providing employees with a copy of the policy and obtaining a written acknowledgement that they have read and understood the policy, or by developing a separate access and use form that describes this policy, to be signed by an employee or associate prior to that individual being provided access to IT systems/network/resources. X X X PL-4.1 Social Media And Networking Restrictions Refer to CITR-022: Access and Use Policy and the DOC Social Media Policy for control details. X X Information Security Architecture PL-8 Information Security Architecture The DOC requires the OUs to: a. Develop an information security architecture for the information system that: 1. Describe the overall philosophy, requirements, and approach to be taken with regard to protecting the X X
2014-doc-itspp.docx