In our article on inventorying systems and information we discussed the advantages of conducing a thorough system and information inventory. We have updated the article with a recommendation from one of our readers that all equipment be labeled with stickers to identify the type(s) of information on that equipment and/or how it is expected to be used in the future. For example, a computer on the production floor of a warehouse might never need to access CUI or FCI. That equipment should be labeled with a sticker reminding employees that the equipment is “Not Authorized for CUI or FCI” (or similar words). This can remind employees not to use that equipment to handle CUI or FCI. By contrast, equipment containing CUI should be labeled “This Equipment Contains CUI”. This can serve as a reminder to employees who are not authorized to access CUI to stay away from the equipment. It also reminds your IT service providers that such equipment may be subject to heightened controls when it is decommissioned. Similar labels can be attached to equipment containing FCI.
Avery 5160 labels can be purchased online and from many office supply stores. Below are templates for stickers which mark equipment that is not authorized for use with FCI or CUI, as well as equipment containing FCI, and equipment containing FCI and CUI.