CM-2 (7) Baseline Configuration | Configure Systems, Components, or Devices for High-risk Areas (M) (H)

NIST 800-53 (r4) Control:

The organization:

(a) Issues [Assignment: organization-defined information systems, system components, or devices] with [Assignment: organization-defined configurations] to individuals traveling to locations that the organization deems to be of significant risk; and

(b) Applies [Assignment: organization-defined security safeguards] to the devices when the individuals return.

NIST 800-53 (r4) Supplemental Guidance:

When it is known that information systems, system components, or devices (e.g., notebook computers, mobile devices) will be located in high-risk areas, additional security controls may be implemented to counter the greater threat in such areas coupled with the lack of physical security relative to organizational-controlled areas. For example, organizational policies and procedures for notebook computers used by individuals departing on and returning from travel include, for example, determining which locations are of concern, defining required configurations for the devices, ensuring that the devices are configured as intended before travel is initiated, and applying specific safeguards to the device after travel is completed. Specially configured notebook computers include, for example, computers with sanitized hard drives, limited applications, and additional hardening (e.g., more stringent configuration settings). Specified safeguards applied to mobile devices upon return from travel include, for example, examining the device for signs of physical tampering and purging/reimaging the hard disk drive. Protecting information residing on mobile devices is covered in the media protection family.

NIST 800-53 (r5) Discussion:

When it is known that systems or system components will be in high-risk areas external to the organization, additional controls may be implemented to counter the increased threat in such areas. For example, organizations can take actions for notebook computers used by individuals departing on and returning from travel. Actions include determining the locations that are of concern, defining the required configurations for the components, ensuring that components are configured as intended before travel is initiated, and applying controls to the components after travel is completed. Specially configured notebook computers include computers with sanitized hard drives, limited applications, and more stringent configuration settings. Controls applied to mobile devices upon return from travel include examining the mobile device for signs of physical tampering and purging and reimaging disk drives. Protecting information that resides on mobile devices is addressed in the MP (Media Protection) family.

38North Guidance:

Meets Minimum Requirement:

• Identify locations that are of significant risk and only issue, define and apply the required secure configurations for any components permitted to travel to those high-risk locations, and apply defined controls to the components after travel is completed.

Best Practice:

• TBD

Unofficial FedRAMP Guidance:

• TBD

Assessment Evidence:

• Documented procedures that identify a list of locations (or criteria for defining locations) that are deemed to be of significant risk, measures to be employed to issue specially configured mobile devices to individuals traveling to locations that the organization deems to be of significant risk, and the inspection and preventative measures to be applied to mobile devices returning from identified locations.

• Configuration settings of mobile devices specially configured for individuals traveling to locations that the organization deems to be of significant risk.

CSP Implementation Tips:

• Amazon Web Services (AWS): TBD

• Microsoft Azure: TBD

• Google Cloud Platform: TBD