Determine and document the alternate facilities and locations employees may use, and at those sites limit access during CJI processing to personnel the agency has authorised, lock the area, room or container when unattended, position devices and documents so unauthorised people cannot access or view CJI, and apply the SC-13 and SC-28 encryption requirements to CJI in transit and at rest; assess the effectiveness of the controls and give employees a way to reach information security and privacy personnel about incidents.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.