Restricted Area and Controlled Area Designation of Areas Housing Critical Information System Components or Classified /Sensitive Technology or Data

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-32600	PH-04.02.01	SV-42937r3_rule		Medium

Description
Failure to designate the areas housing the critical information technology systems as a restricted or controlled access area may result in inadequate protection being assigned during emergency actions or the site having insufficient physical security protection measures in place. Further, warning signs may not be in place to advise visitors or other unauthorized persons that such areas are off-limits, resulting in inadvertent access by unauthorized persons. REFERENCES: DoD 5200.22-M (NISPOM), February 2006, Incorporating Change 2, May 18, 2016 Appendix C - Definition of Restricted Area and Chapter 5, para 5-305. NIST Special Publication 800-53 (SP 800-53) Controls: PE-2 and PE-3 DoD 5200.8-R Physical Security Program Definitions: DL1.12., and Chapter 3, para C3.2.4.

Description

Failure to designate the areas housing the critical information technology systems as a restricted or controlled access area may result in inadequate protection being assigned during emergency actions or the site having insufficient physical security protection measures in place. Further, warning signs may not be in place to advise visitors or other unauthorized persons that such areas are off-limits, resulting in inadvertent access by unauthorized persons. REFERENCES: DoD 5200.22-M (NISPOM), February 2006, Incorporating Change 2, May 18, 2016 Appendix C - Definition of Restricted Area and Chapter 5, para 5-305. NIST Special Publication 800-53 (SP 800-53) Controls: PE-2 and PE-3 DoD 5200.8-R Physical Security Program Definitions: DL1.12., and Chapter 3, para C3.2.4.

STIG	Date
Traditional Security Checklist	2020-08-26

Details

Check Text ( C-41039r3_chk )
Check to ensure the areas housing critical information technology systems are designated as Restricted Areas or Controlled Areas IAW host installation and/or Service, Agency or COCOM guidance. Signage should be properly posted at all access points and at adequate intervals to advise those approaching of the restricted area/controlled area designation, authority and consequences for violation of access restrictions. Signs will be in English as well as in any language prevalent in the area. Signs may not be required where OPSEC countermeasures dictate. TACTICAL ENVIRONMENT: The check is applicable for fixed (established) tactical processing environments. Not applicable to a field/mobile environment.

Check Text ( C-41039r3_chk )

Check to ensure the areas housing critical information technology systems are designated as Restricted Areas or Controlled Areas IAW host installation and/or Service, Agency or COCOM guidance.

Signage should be properly posted at all access points and at adequate intervals to advise those approaching of the restricted area/controlled area designation, authority and consequences for violation of access restrictions. Signs will be in English as well as in any language prevalent in the area. Signs may not be required where OPSEC countermeasures dictate.

TACTICAL ENVIRONMENT: The check is applicable for fixed (established) tactical processing environments. Not applicable to a field/mobile environment.

Fix Text (F-36515r2_fix)
Ensure the areas housing critical information technology systems are designated as Restricted Areas or Controlled Areas IAW host installation and/or Service, Agency or COCOM guidance. Signage should be properly posted at all access points and at adequate intervals to advise those approaching of the restricted area/controlled area designation, authority and consequences for violation of access restrictions. Signs will be in English as well as in any language prevalent in the area. Signs may not be required where OPSEC countermeasures dictate.

Fix Text (F-36515r2_fix)

Ensure the areas housing critical information technology systems are designated as Restricted Areas or Controlled Areas IAW host installation and/or Service, Agency or COCOM guidance.

Signage should be properly posted at all access points and at adequate intervals to advise those approaching of the restricted area/controlled area designation, authority and consequences for violation of access restrictions. Signs will be in English as well as in any language prevalent in the area. Signs may not be required where OPSEC countermeasures dictate.