id: "PM-17" title: "Protecting Controlled Unclassified Information on External Systems" family: "PM" family_name: "Program Management" sort_id: "pm-17" priority: "P1" implementation_level: "organization"
Establish policy and procedures to ensure that requirements for the protection of controlled unclassified information that is processed, stored or transmitted on external systems, are implemented in accordance with applicable laws, executive orders, directives, policies, regulations, and standards; and
Review and update the policy and procedures {{ insert: param, pm-17_prm_1 }}.
Guidance
Controlled unclassified information is defined by the National Archives and Records Administration along with the safeguarding and dissemination requirements for such information and is codified in 32 CFR 2002 and, specifically for systems external to the federal organization, 32 CFR 2002.14h . The policy prescribes the specific use and conditions to be implemented in accordance with organizational procedures, including via its contracting processes.
Assessment Objective: policy is established to ensure that requirements for the protection of controlled unclassified information that is processed, stored, or transmitted on external systems are implemented in accordance with applicable laws, executive orders, directives, policies, regulations, and standards;
Assessment Objective: procedures are established to ensure that requirements for the protection of controlled unclassified information that is processed, stored, or transmitted on external systems are implemented in accordance with applicable laws, executive orders, directives, policies, regulations, and standards;
Assessment Objective: policy is reviewed and updated {{ insert: param, pm-17_odp.01 }};
Assessment Objective: procedures are reviewed and updated {{ insert: param, pm-17_odp.02 }}
Controlled unclassified information policy
controlled unclassified information procedures
other relevant documents or records.
Organizational personnel with controlled unclassified information responsibilities
organizational personnel with information security responsibilities.