{"data":{"id":"CM-12","name":"Information Location","family":"CM","family_name":"Configuration Management","withdrawn":false,"description":"a. Identify and document the location of [Assignment: organization-defined information] and the specific system components on which the information is processed and stored;\nb. Identify and document the users who have access to the system and system components where the information is processed and stored; and\nc. Document changes to the location (i.e., system or system components) where the information is processed and stored.","supplemental_guidance":"Information location addresses the need to understand where information is being processed and stored. Information location includes identifying where specific information types and information reside in system components and how information is being processed so that information flow can be understood and adequate protection and policy management provided for such information and system components. The security category of the information is also a factor in determining the controls necessary to protect the information and the system component where the information resides (see [FIPS 199]). The location of the information and system components is also a factor in the architecture and design of the system (see SA-4, SA-8, SA-17).","enhancements":[{"id":"CM-12(01)","name":"Automated Tools to Support Information Location","statement":"Use automated tools to identify [Assignment: organization-defined information by information type] on [Assignment: organization-defined system components] to ensure controls are in place to protect organizational information and individual privacy.","baselines":["moderate","high"]}],"baseline_low":false,"baseline_moderate":true,"baseline_high":true,"nist_800_53":{"rev5":{"id":"CM-12","name":"Information Location","description":"a. Identify and document the location of [Assignment: organization-defined information] and the specific system components on which the information is processed and stored;\nb. Identify and document the users who have access to the system and system components where the information is processed and stored; and\nc. Document changes to the location (i.e., system or system components) where the information is processed and stored.","discussion":"Information location addresses the need to understand where information is being processed and stored. Information location includes identifying where specific information types and information reside in system components and how information is being processed so that information flow can be understood and adequate protection and policy management provided for such information and system components. The security category of the information is also a factor in determining the controls necessary to protect the information and the system component where the information resides (see [FIPS 199]). The location of the information and system components is also a factor in the architecture and design of the system (see SA-4, SA-8, SA-17).","related_controls":["AC-02","AC-03","AC-04","AC-06","AC-23","CM-08","PM-05","RA-02","SA-04","SA-08","SA-17","SC-04","SC-16","SC-28","SI-04","SI-07"],"baseline_low":null,"baseline_moderate":true,"baseline_high":true,"baseline_privacy":null,"new_in_rev5":true,"changes_from_rev4":"New control in Rev 5."}},"compliance_mappings":{"iso_27001_2022":["A.5.9"],"iso_27002_2022":["5.9"],"cobit_2019":["APO14","BAI09","BAI10"],"pci_dss_v4":["3.1","3.2","3.5","12.5"],"nist_csf_2":["ID.AM-03","ID.AM-07"],"cis_controls_v8":["CIS 1","CIS 1.1","CIS 1.3","CIS 1.4","CIS 1.5","CIS 2","CIS 2.1","CIS 2.4","CIS 3","CIS 3.2","CIS 3.8"],"soc2_tsc":["C1.1","CC6.1-POF1"],"finos_ccc":["CCC-C06","CCC-C16"],"iso_42001_2023":["A.4.2","A.7.3"],"iec_62443":[],"asd_e8":["E8-2 ML3"],"nis2":["Art. 21(2)(i)"],"apra_cps_234":["Para 21"],"mas_trm":["11"],"pra_op_resilience":["SS1/21-3.1","SS1/21-5.2","SS2/21-14.1"],"bsi_grundschutz":["NET.1.2"],"anssi":["Hygiene.5","SecNumCloud.9.1"],"osfi_b13":["B-13.2.1"],"finma_circular":["IV.A(28)","IV.A(30)","IV.A(31)","IV.D(78)","IV.D(79)"],"gdpr":["Art.5(1)(c)","Art.5(1)(e)","Art.25(1)","Art.30(1)","Art.35(7)(a)","Rec.78"],"dora":["Art.8(1)","Art.8(4)","Art.28(4)"],"bio2":["5.9"],"rbi_csf":["Annex1.1"],"fisc":["FISC.O9","FISC.T5"],"lgpd_bcb":["BCB.Art.13","BCB.Art.14","BCB.Art.20","LGPD.Art.6"],"hkma_tme1":["TME1.7.2","TME1.12.4"],"mlps_2":[],"dnb_good_practice":[],"cra":["CRA.II.1"],"swift_cscf":[],"cbb_tm":["TM-9","TM-15"],"cbuae":["CR-5"],"nca_ecc":["2-1"],"qatar_nia":["AM","OS"],"sama_csf":["2.1"],"uae_ia":["T4"],"bog_cisd":["CISD-V","CISD-XII"],"bom_ctrm":["2.1"],"cbe_csf":["CRM-2","CTO-2"],"cbn_csf":["Part3.1","Part3.4"],"popia":["s10","s14","s17"],"sa_js2":["JS2-6.1","JS2-8.2"],"bcbs_239":["Principle 2","Principle 4"],"bot_cyber":["Ch2.1"],"cpmi_pfmi":["CG.ID"],"eba_ict":["3.3.2"],"ecb_croe":["CROE.2.2.2"],"ffiec_is":["II.C.5"],"iosco_cyber":["ID-1","ID-2","ID-4"],"nydfs_500":["500.13"],"sebi_cscrf":["ID.AM"],"cmmc_2":["CM"],"nerc_cip":[],"nrc_73_54":[],"tsa_psd":[],"ieee_1686":[],"ferc_cip":[],"doe_c2m2":[],"api_1164":[],"awia":[],"iaea_nss":[],"pci_pts":[],"fips_140":[],"cbest":["CBEST.3"],"tiber_eu":[],"pci_hsm":[],"common_criteria":[],"isae_3402":["Clause 9"],"fca_sysc_13":[],"fda_21_cfr_11":[],"fda_cyber":[],"hitrust_csf":["07.a"],"iso_27799":["8.1"],"lloyds_ms":["MS1.1","MS2.1","MS6.1","MS8.7","MS9.1","MS13.1"],"naic_ds":["3","4-asset"],"nhs_dspt":["NDG-5.3","NDG-8.3"],"pra_ss1_23":["P1.1","P3.2"],"solvency_ii":["DR.266-DataSec","EIOPA-Cloud-GL9","EIOPA-ICT-4.3"],"owasp_masvs_v2":[],"csa_ccm_v4":[],"csa_aicm":[],"ccss_v9":[],"mica":[],"basel_sco60":[],"bssc":[],"sec_custody_digital":[],"dpdpa":["Act.16","Rules.13(4)","Rules.15"]},"attack_techniques":[{"id":"T1005","name":"Data from Local System","tactics":["collection"],"mapping_type":"mitigates","mapping_rationale":"Identifying and documenting where sensitive information resides on specific system components enables targeted data protection controls and detection of unauthorized access to systems storing critical data."},{"id":"T1025","name":"Data from Removable Media","tactics":["collection"],"mapping_type":"mitigates","mapping_rationale":"Tracking information location across systems and removable media enables organizations to restrict sensitive data storage to approved locations where proper access controls and monitoring are enforced."}],"metadata":{"last_reviewed":"2026-02-19","review_notes":"","mapping_status":"complete"},"function":"preventative","used_by_patterns":[]}}