CM-12 Information Location

Guidance: draftPolicy clause: draftWhat these mean

Baselines	Implementation level	Enhancements
Moderate, High	Organization	1 (1 in a baseline)

Related controls: AC-2, AC-3, AC-4, AC-6, AC-23, CM-8, PM-5, RA-2, SA-4, SA-8, SA-17, SC-4, SC-16, SC-28, SI-4, SI-7

Control statement

• a. Identify and document the location of [Assignment: organization-defined information] and the specific system components on which the information is processed and stored;
• b. Identify and document the users who have access to the system and system components where the information is processed and stored; and
• c. Document changes to the location (i.e., system or system components) where the information is processed and stored.

NIST discussion

Information location addresses the need to understand where information is being processed and stored. Information location includes identifying where specific information types and information reside in system components and how information is being processed so that information flow can be understood and adequate protection and policy management provided for such information and system components. The security category of the information is also a factor in determining the controls necessary to protect the information and the system component where the information resides (see FIPS 199 ). The location of the information and system components is also a factor in the architecture and design of the system (see SA-4, SA-8, SA-17).

Control enhancements

CM-12(1) Automated Tools to Support Information Location

Baselines: Moderate, High

Use automated tools to identify [Assignment: organization-defined information by information type] on [Assignment: organization-defined system components] to ensure controls are in place to protect organizational information and individual privacy.

Discussion and assessment objectives for CM-12(1)

The use of automated tools helps to increase the effectiveness and efficiency of the information location capability implemented within the system. Automation also helps organizations manage the data produced during information location activities and share such information across the organization. The output of automated information location tools can be used to guide and inform system architecture and design decisions.

Determine if automated tools are used to identify [Assignment: organization-defined information by information type] on [Assignment: organization-defined system components] to ensure that controls are in place to protect organizational information and individual privacy.

Examine: Configuration management policy; procedures addressing identification and documentation of information location; configuration management plan; system design documentation; PII inventory documentation; data mapping documentation; change control records; system component inventory; system security plan; privacy plan; other relevant documents or records.

Interview: Organizational personnel with responsibilities for managing information location; organizational personnel with information security responsibilities; system/network administrators; system developers.

Test: Organizational processes governing information location; automated mechanisms enforcing policies and methods for governing information location; automated tools used to identify information on system components.

Assessment objectives (SP 800-53A)

Objectives and methods for CM-12

Determine if:

• CM-12a.
  • CM-12a.[01] the location of [Assignment: organization-defined information] is identified and documented;
  • CM-12a.[02] the specific system components on which [Assignment: organization-defined information] is processed are identified and documented;
  • CM-12a.[03] the specific system components on which [Assignment: organization-defined information] is stored are identified and documented;
• CM-12b.
  • CM-12b.[01] the users who have access to the system and system components where [Assignment: organization-defined information] is processed are identified and documented;
  • CM-12b.[02] the users who have access to the system and system components where [Assignment: organization-defined information] is stored are identified and documented;
• CM-12c.
  • CM-12c.[01] changes to the location (i.e., system or system components) where [Assignment: organization-defined information] is processed are documented;
  • CM-12c.[02] changes to the location (i.e., system or system components) where [Assignment: organization-defined information] is stored are documented.

Examine: Configuration management policy; procedures addressing identification and documentation of information location; configuration management plan; system design documentation; system architecture documentation; PII inventory documentation; data mapping documentation; audit records; list of users with system and system component access; change control records; system component inventory; system security plan; privacy plan; other relevant documents or records.

Interview: Organizational personnel with responsibilities for managing information location and user access to information; organizational personnel with responsibilities for operating, using, and/or maintaining the system; organizational personnel with information security and privacy responsibilities; system/network administrators; system developers.

Test: Organizational processes governing information location; mechanisms enforcing policies and methods for governing information location.

Policy statement

• The System owner shall identify and document the location of Fill in: information for which the location is to be identified and documented Typical: the information types listed in the system security plan and the specific components on which it is processed and stored. (CM-12a)
• The System owner shall identify and document the users who have access to the system and components where that information is processed and stored. (CM-12b)
• The System owner shall document changes to the location where that information is processed and stored. (CM-12c)

CM-12(1) Automated tools to support information location

• The System owner shall use automated tools to identify Fill in: information to be protected is defined by information type Typical: personal information and other sensitive information types listed in the system security plan on Fill in: system components where the information is located Typical: file shares, databases, cloud storage and endpoints to confirm controls are in place to protect organizational information and individual privacy. (CM-12(1))

From the Configuration Management Policy template (draft). Highlighted fields are values your organization sets.

How to apply it

CM-12 asks you to know where specific information lives: which components process and store it, who has access to those components, and when that changes. NIST’s CM-12 discussion ties this to understanding information flow, so the information and the components that hold it get the right protection, and notes that the information’s security category (FIPS 199) helps decide which controls those components need. Where information is located also shapes the system’s architecture and design (SA-4, SA-8, SA-17).

Common implementations. A data map for the system that lists each information type from the system security plan, section 6, with the databases, storage, file shares, cloud services and regions, backups and endpoints where it is processed and stored. The components the map names are the ones in the component inventory (CM-8). Access to those components comes from the account lists kept under AC-2. A change that moves information to a new location, such as a new cloud region, storage service or backup target, goes through change control (CM-3) and updates the map. For personal information, the privacy impact assessment describes the same flows, so keep the two consistent.

Organization-defined parameters. Typical values, which your organization may set differently:

Parameter	Typical value
Information whose location is documented (a)	The information types listed in the system security plan
Information types the automated tools look for (CM-12(1))	Personal information and other sensitive information types listed in the system security plan
Components the automated tools scan (CM-12(1))	File shares, databases, cloud storage and endpoints

In the Configuration Management policy, the system owner identifies and documents the locations, the users with access and changes to the locations.

Evidence assessors ask for.

• The data map or equivalent, listing each information type and where it is processed and stored
• The users and roles with access to those components
• Change records that updated the map when information moved
• Scan results from the automated discovery tools, and the follow-up on information found where it should not be (CM-12(1))

Inheritance. Data discovery tools are often common. Each system owns documenting where its information lives, so CM-12 is usually a hybrid control.

Common findings.

• A data map that leaves out backups, logs, analytics copies or test environments holding production data.
• Information found by discovery scans in locations the map does not list.
• Cloud regions or services added without updating the map.
• No list of who can access the components that hold sensitive information.

Enhancements in the Moderate baseline. CM-12(1) automated tools to support information location, which is also in High. Data discovery or data loss prevention tools scan file shares, databases, cloud storage and endpoints for personal and other sensitive information, so you can confirm controls are in place where the information actually is. NIST’s discussion notes the results can also guide architecture and design decisions.

Artifacts

• Configuration Management Decision Worksheet
• Configuration Management Policy