id: "SC-42(01)" title: "Reporting to Authorized Individuals or Roles" family: "SC" family_name: "System and Communications Protection" sort_id: "sc-42.01" priority: "P1" implementation_level: "organization" parent: "SC-42" enhancement: True
Statement
Verify that the system is configured so that data or information collected by the {{ insert: param, sc-42.01_odp }} is only reported to authorized individuals or roles.
Guidance
In situations where sensors are activated by authorized individuals, it is still possible that the data or information collected by the sensors will be sent to unauthorized entities.
Assessment Objective
the system is configured so that data or information collected by the {{ insert: param, sc-42.01_odp }} is only reported to authorized individuals or roles.
System and communications protection policy
access control policy and procedures
procedures addressing sensor capability and data collection
personally identifiable information processing policy
system design documentation
system configuration settings and associated documentation
system architecture
system audit records
system security plan
privacy plan
other relevant documents or records
System/network administrators
organizational personnel with information security and privacy responsibilities
system developer
organizational personnel installing, configuring, and/or maintaining the system
organizational personnel responsible for the sensor capabilities
Mechanisms restricting the reporting of sensor information to those authorized
sensor data collection and reporting capabilities for the system