Agencies must produce a Site Security Plan (SitePlan) for every server and communications room. The information covered includes, without being limited to: a summary of the facility's security risk review for the building where the room sits; the roles and responsibilities of security and facility personnel; administration, operation and maintenance of the security alarm system or the electronic access control system; key management, enrolling and removing system users, and issuing passwords and personal identification number codes; security clearances of personnel, security awareness training and briefings held regularly; regular inspection of the logs and audit trails that are generated; checks and lockup at the end of the day; reporting of information security incidents; and the activities to carry out in response to security alarms.
This control maps to 1 controls across 1 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.
The graph holds this control, the 1 it maps to, and the evidence behind each claim, over MCP and REST.