GOV-04 Publishing Security, Compliance & Resilience Documentation

Assessment Objectives

In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that:

GOV-04_A01 cybersecurity / data privacy policies are developed and documented.
Assessment rigor: 1
Origin: 53A_R5_AC-01a.[01] 53A_R5_AT-01a.[01] 53A_R5_AU-01a.[01] 53A_R5_CA-01a.[01] 53A_R5_CM-01a.[01] 53A_R5_CP-01a.[01] 53A_R5_IA-01a.[01] 53A_R5_IR-01a.[01] 53A_R5_MA-01a.[01] 53A_R5_MP-01a.[01] 53A_R5_PE-01a.[01] 53A_R5_PL-01a.[01] 53A_R5_PS-01a.[01] 53A_R5_PT-01a.[01] 53A_R5_RA-01a.[01] 53A_R5_SA-01a.[01] 53A_R5_SC-01a.[01] 53A_R5_SI-01a.[01] 53A_R5_SR-01a.[01] 171A_3.4.9[a] 171A_3.9.2[a] 53A_R5_AC-02a.[03] 53A_R5_AC-04(25)_ODP[02] 53A_R5_IA-04(05)_ODP 53A_R5_SR-11a.[03]
GOV-04_A02 policies needed to satisfy the security requirements for the protection of sensitive / regulated data are developed and documented.
Defined parameters: at least annually
Assessment rigor: 1
Origin: SCF Created
GOV-04_A03 policies needed to satisfy the security requirements for the protection of sensitive / regulated data are disseminated to organizational personnel or roles.
Assessment rigor: 1
Origin: SCF Created
GOV-04_A04 procedures needed to satisfy the security requirements for the protection of sensitive / regulated data are developed and documented.
Defined parameters: at least annually
Assessment rigor: 1
Origin: SCF Created
GOV-04_A05 procedures needed to satisfy the security requirements for the protection of sensitive / regulated data are disseminated to organizational personnel or roles.
Assessment rigor: 1
Origin: SCF Created
GOV-04_A06 the cybersecurity / data privacy policies address purpose.
Assessment rigor: 3
Origin: 53A_R5_AC-01a.01(a)[01] 53A_R5_AT-01a.01(a)[01] 53A_R5_AU-01a.01(a)[01] 53A_R5_CA-01a.01(a)[01] 53A_R5_CM-01a.01(a)[01] 53A_R5_CP-01a.01(a)[01] 53A_R5_IA-01a.01(a)[01] 53A_R5_IR-01a.01(a)[01] 53A_R5_MA-01a.01(a)[01] 53A_R5_MP-01a.01(a)[01] 53A_R5_PE-01a.01(a)[01] 53A_R5_PL-01a.01(a)[01] 53A_R5_PS-01a.01(a)[01] 53A_R5_PT-01a.01(a)[01] 53A_R5_RA-01a.01(a)[01] 53A_R5_SA-01a.01(a)[01] 53A_R5_SC-01a.01(a)[01] 53A_R5_SI-01a.01(a)[01] 53A_R5_SR-01a.01(a)[01]
GOV-04_A07 the cybersecurity / data privacy policies address scope.
Assessment rigor: 3
Origin: 53A_R5_AC-01a.01(a)[02] 53A_R5_AT-01a.01(a)[02] 53A_R5_AU-01a.01(a)[02] 53A_R5_CA-01a.01(a)[02] 53A_R5_CM-01a.01(a)[02] 53A_R5_CP-01a.01(a)[02] 53A_R5_IA-01a.01(a)[02] 53A_R5_IR-01a.01(a)[02] 53A_R5_MA-01a.01(a)[02] 53A_R5_MP-01a.01(a)[02] 53A_R5_PE-01a.01(a)[02] 53A_R5_PL-01a.01(a)[02] 53A_R5_PS-01a.01(a)[02] 53A_R5_PT-01a.01(a)[02] 53A_R5_RA-01a.01(a)[02] 53A_R5_SA-01a.01(a)[02] 53A_R5_SC-01a.01(a)[02] 53A_R5_SI-01a.01(a)[02] 53A_R5_SR-01a.01(a)[02]
GOV-04_A08 the cybersecurity / data privacy policies address roles.
Assessment rigor: 3
Origin: 53A_R5_AC-01a.01(a)[03] 53A_R5_AT-01a.01(a)[03] 53A_R5_AU-01a.01(a)[03] 53A_R5_CA-01a.01(a)[03] 53A_R5_CM-01a.01(a)[03] 53A_R5_CP-01a.01(a)[03] 53A_R5_IA-01a.01(a)[03] 53A_R5_IR-01a.01(a)[03] 53A_R5_MA-01a.01(a)[03] 53A_R5_MP-01a.01(a)[03] 53A_R5_PE-01a.01(a)[03] 53A_R5_PL-01a.01(a)[03] 53A_R5_PS-01a.01(a)[03] 53A_R5_PT-01a.01(a)[03] 53A_R5_RA-01a.01(a)[03] 53A_R5_SA-01a.01(a)[03] 53A_R5_SC-01a.01(a)[03] 53A_R5_SI-01a.01(a)[03] 53A_R5_SR-01a.01(a)[03]
GOV-04_A09 the cybersecurity / data privacy policies address responsibilities.
Assessment rigor: 3
Origin: 53A_R5_AC-01a.01(a)[04] 53A_R5_AT-01a.01(a)[04] 53A_R5_AU-01a.01(a)[04] 53A_R5_CA-01a.01(a)[04] 53A_R5_CM-01a.01(a)[04] 53A_R5_CP-01a.01(a)[04] 53A_R5_IA-01a.01(a)[04] 53A_R5_IR-01a.01(a)[04] 53A_R5_MA-01a.01(a)[04] 53A_R5_MP-01a.01(a)[04] 53A_R5_PE-01a.01(a)[04] 53A_R5_PL-01a.01(a)[04] 53A_R5_PS-01a.01(a)[04] 53A_R5_PT-01a.01(a)[04] 53A_R5_RA-01a.01(a)[04] 53A_R5_SA-01a.01(a)[04] 53A_R5_SC-01a.01(a)[04] 53A_R5_SI-01a.01(a)[04] 53A_R5_SR-01a.01(a)[04]
GOV-04_A10 the cybersecurity / data privacy policies address management commitment.
Assessment rigor: 3
Origin: 53A_R5_AC-01a.01(a)[05] 53A_R5_AT-01a.01(a)[05] 53A_R5_AU-01a.01(a)[05] 53A_R5_CA-01a.01(a)[05] 53A_R5_CM-01a.01(a)[05] 53A_R5_CP-01a.01(a)[05] 53A_R5_IA-01a.01(a)[05] 53A_R5_IR-01a.01(a)[05] 53A_R5_MA-01a.01(a)[05] 53A_R5_MP-01a.01(a)[05] 53A_R5_PE-01a.01(a)[05] 53A_R5_PL-01a.01(a)[05] 53A_R5_PS-01a.01(a)[05] 53A_R5_PT-01a.01(a)[05] 53A_R5_RA-01a.01(a)[05] 53A_R5_SA-01a.01(a)[05] 53A_R5_SC-01a.01(a)[05] 53A_R5_SI-01a.01(a)[05] 53A_R5_SR-01a.01(a)[05]
GOV-04_A11 the cybersecurity / data privacy policies address coordination among organizational entities.
Assessment rigor: 3
Origin: 53A_R5_AC-01a.01(a)[06] 53A_R5_AT-01a.01(a)[06] 53A_R5_AU-01a.01(a)[06] 53A_R5_CA-01a.01(a)[06] 53A_R5_CM-01a.01(a)[06] 53A_R5_CP-01a.01(a)[06] 53A_R5_IA-01a.01(a)[06] 53A_R5_IR-01a.01(a)[06] 53A_R5_MA-01a.01(a)[06] 53A_R5_MP-01a.01(a)[06] 53A_R5_PE-01a.01(a)[06] 53A_R5_PL-01a.01(a)[06] 53A_R5_PS-01a.01(a)[06] 53A_R5_PT-01a.01(a)[06] 53A_R5_RA-01a.01(a)[06] 53A_R5_SA-01a.01(a)[06] 53A_R5_SC-01a.01(a)[06] 53A_R5_SI-01a.01(a)[06] 53A_R5_SR-01a.01(a)[06]
GOV-04_A12 the cybersecurity / data privacy policies address compliance.
Assessment rigor: 3
Origin: 53A_R5_AC-01a.01(a)[07] 53A_R5_AT-01a.01(a)[07] 53A_R5_AU-01a.01(a)[07] 53A_R5_CA-01a.01(a)[07] 53A_R5_CM-01a.01(a)[07] 53A_R5_CP-01a.01(a)[07] 53A_R5_IA-01a.01(a)[07] 53A_R5_IR-01a.01(a)[07] 53A_R5_MA-01a.01(a)[07] 53A_R5_MP-01a.01(a)[07] 53A_R5_PE-01a.01(a)[07] 53A_R5_PL-01a.01(a)[07] 53A_R5_PS-01a.01(a)[07] 53A_R5_PT-01a.01(a)[07] 53A_R5_RA-01a.01(a)[07] 53A_R5_SA-01a.01(a)[07] 53A_R5_SC-01a.01(a)[07] 53A_R5_SI-01a.01(a)[07] 53A_R5_SR-01a.01(a)[07]
GOV-04_A13 the cybersecurity / data privacy policies are consistent with applicable laws, regulations and contractual obligations.
Assessment rigor: 3
Origin: 53A_R5_AC-01a.01(b) 53A_R5_AT-01a.01(b) 53A_R5_AU-01a.01(b) 53A_R5_CA-01a.01(b) 53A_R5_CM-01a.01(b) 53A_R5_CP-01a.01(b) 53A_R5_IA-01a.01(b) 53A_R5_IR-01a.01(b) 53A_R5_MA-01a.01(b) 53A_R5_MP-01a.01(b) 53A_R5_PE-01a.01(b) 53A_R5_PL-01a.01(b) 53A_R5_PS-01a.01(b) 53A_R5_PT-01a.01(b) 53A_R5_RA-01a.01(b) 53A_R5_SA-01a.01(b) 53A_R5_SC-01a.01(b) 53A_R5_SI-01a.01(b) 53A_R5_SR-01a.01(b)
GOV-04_A14 personnel or roles to whom the cybersecurity / data privacy policies are to be disseminated is/are defined.
Assessment rigor: 3
Origin: 53A_R5_AC-01_ODP[01] 53A_R5_AT-01_ODP[01] 53A_R5_AU-01_ODP[01] 53A_R5_CA-01_ODP[01] 53A_R5_CM-01_ODP[01] 53A_R5_CP-01_ODP[01] 53A_R5_IA-01_ODP[01] 53A_R5_IR-01_ODP[01] 53A_R5_MA-01_ODP[01] 53A_R5_MP-01_ODP[01] 53A_R5_PE-01_ODP[01] 53A_R5_PL-01_ODP[01] 53A_R5_PS-01_ODP[01] 53A_R5_PT-01_ODP[01] 53A_R5_RA-01_ODP[01] 53A_R5_SA-01_ODP[01] 53A_R5_SC-01_ODP[01] 53A_R5_SI-01_ODP[01] 53A_R5_SR-01_ODP[01]
GOV-04_A15 the cybersecurity / data privacy policies are disseminated to personnel or roles.
Assessment rigor: 3
Origin: 53A_R5_AC-01a.[02] 53A_R5_AT-01a.[02] 53A_R5_AU-01a.[02] 53A_R5_CA-01a.[02] 53A_R5_CM-01a.[02] 53A_R5_CP-01a.[02] 53A_R5_IA-01a.[02] 53A_R5_IR-01a.[02] 53A_R5_MA-01a.[02] 53A_R5_MP-01a.[02] 53A_R5_PE-01a.[02] 53A_R5_PL-01a.[02] 53A_R5_PS-01a.[02] 53A_R5_PT-01a.[02] 53A_R5_RA-01a.[02] 53A_R5_SA-01a.[02] 53A_R5_SC-01a.[02] 53A_R5_SI-01a.[02] 53A_R5_SR-01a.[02]
GOV-04_A16 the official is designated to manage the development, documentation and dissemination of the cybersecurity / data privacy policies and procedures.
Assessment rigor: 3
Origin: 53A_R5_AC-01b 53A_R5_AT-01b 53A_R5_AU-01b 53A_R5_CA-01b 53A_R5_CM-01b 53A_R5_CP-01b 53A_R5_IA-01b 53A_R5_IR-01b 53A_R5_MA-01b 53A_R5_MP-01b 53A_R5_PE-01b 53A_R5_PL-01b 53A_R5_PS-01b 53A_R5_PT-01b 53A_R5_RA-01b 53A_R5_SA-01b 53A_R5_SC-01b 53A_R5_SI-01b 53A_R5_SR-01b
GOV-04_A17 an official to manage the governance of cybersecurity / data privacy policies and procedures is defined.
Assessment rigor: 2
Origin: 53A_R5_AC-01_ODP[04] 53A_R5_AT-01_ODP[04] 53A_R5_AU-01_ODP[04] 53A_R5_CA-01_ODP[04] 53A_R5_CM-01_ODP[04] 53A_R5_CP-01_ODP[04] 53A_R5_IA-01_ODP[04] 53A_R5_IR-01_ODP[04] 53A_R5_MA-01_ODP[04] 53A_R5_MP-01_ODP[04] 53A_R5_PE-01_ODP[04] 53A_R5_PL-01_ODP[04] 53A_R5_PS-01_ODP[04] 53A_R5_PT-01_ODP[04] 53A_R5_RA-01_ODP[04] 53A_R5_SA-01_ODP[04] 53A_R5_SC-01_ODP[04] 53A_R5_SI-01_ODP[04] 53A_R5_SR-01_ODP[04] 171A_3.4.9[a] 171A_3.9.2[a] 53A_R5_AC-02a.[03] 53A_R5_AC-04(25)_ODP[02] 53A_R5_IA-04(05)_ODP 53A_R5_SR-11a.[03]
GOV-04_A18 policies needed to satisfy the security requirements for the protection of CUI are developed and documented.
Assessment rigor: NIST 800-171
Origin: 171A_R3_A.03.15.01.a[01]
GOV-04_A19 policies needed to satisfy the security requirements for the protection of CUI are disseminated to organizational personnel or roles.
Assessment rigor: NIST 800-171
Origin: 171A_R3_A.03.15.01.a[02]
GOV-04_A20 procedures needed to satisfy the security requirements for the protection of CUI are developed and documented.
Assessment rigor: NIST 800-171
Origin: 171A_R3_A.03.15.01.a[03]
GOV-04_A21 procedures needed to satisfy the security requirements for the protection of CUI are disseminated to organizational personnel or roles.
Assessment rigor: NIST 800-171
Origin: 171A_R3_A.03.15.01.a[04]

Свързани задачи

Връзки
Тип връзка	Задача
blocks	Publishing Security, Compliance & Resilience Documentation

Secure Controls Framework -
EN: GRCA includes the Secure Controls Framework® (SCF) content, © Secure Controls Framework Council, LLC, used under the Creative Commons Attribution-NoDerivatives 4.0 International Public License. SCF control numbers, names, descriptions and mappings appear exactly as published by the SCF Council – https://securecontrolsframework.com. GRCA may group or reorder SCF content for display, which does not change SCF content; the mappings are shown as links to the frameworks they name. Learn more at https://securecontrolsframework.com.

DE: GRCA enthält Inhalte des Secure Controls Framework® (SCF), © Secure Controls Framework Council, LLC, genutzt unter der Creative Commons Attribution-NoDerivatives 4.0 International Public License. Nummern, Namen, Beschreibungen und Zuordnungen der SCF-Controls erscheinen genau so, wie der SCF Council sie veröffentlicht – https://securecontrolsframework.com. GRCA gruppiert oder sortiert SCF-Inhalte für die Anzeige, ohne sie zu verändern; die Zuordnungen erscheinen als Verknüpfungen zu den genannten Regelwerken. Mehr unter https://securecontrolsframework.com.