id: "SC-28(02)" title: "Offline Storage" family: "SC" family_name: "System and Communications Protection" sort_id: "sc-28.02" priority: "P1" implementation_level: "organization" parent: "SC-28" enhancement: True
Statement
Remove the following information from online storage and store offline in a secure location: {{ insert: param, sc-28.02_odp }}.
Guidance
Removing organizational information from online storage to offline storage eliminates the possibility of individuals gaining unauthorized access to the information through a network. Therefore, organizations may choose to move information to offline storage in lieu of protecting such information in online storage.
Assessment Objective: {{ insert: param, sc-28.02_odp }} is removed from online storage;
Assessment Objective: {{ insert: param, sc-28.02_odp }} is stored offline in a secure location.
System and communications protection policy
procedures addressing the protection of information at rest
system design documentation
system configuration settings and associated documentation
cryptographic mechanisms and associated configuration documentation
offline storage locations for information at rest
system audit records
system security plan
other relevant documents or records
System/network administrators
organizational personnel with information security responsibilities
Mechanisms supporting and/or implementing the removal of information from online storage
mechanisms supporting and/or implementing storage of information offline