id: "IR-09(04)" title: "Exposure to Unauthorized Personnel" family: "IR" family_name: "Incident Response" sort_id: "ir-09.04" priority: "P2" implementation_level: "organization" parent: "IR-09" enhancement: True
Statement
Employ the following controls for personnel exposed to information not within assigned access authorizations: {{ insert: param, ir-09.04_odp }}.
Guidance
Controls include ensuring that personnel who are exposed to spilled information are made aware of the laws, executive orders, directives, regulations, policies, standards, and guidelines regarding the information and the restrictions imposed based on exposure to such information.
Assessment Objective
{{ insert: param, ir-09.04_odp }} are employed for personnel exposed to information not within assigned access authorizations.
Incident response policy
procedures addressing incident response
procedures addressing information spillage
incident response plan
system security plan
security safeguards regarding information spillage/exposure to unauthorized personnel
other relevant documents or records
Organizational personnel with incident response responsibilities
organizational personnel with information security responsibilities
Organizational processes for dealing with information exposed to unauthorized personnel
mechanisms supporting and/or implementing safeguards for personnel exposed to information not within assigned access authorizations