Assessment Objectives

In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that:

• CPL-07_A01 a compliance catalog of applicable laws, regulations and contractual obligations is documented.
  Assessment rigor: 1
  Origin: SCF Created
• CPL-07_A02 a continuous monitoring strategy is developed for cybersecurity / data privacy controls.
  Assessment rigor: 1
  Origin: 53A_R5_CA-07[01]
• CPL-07_A03 continuous control monitoring is implemented in accordance with the organization's continuous monitoring strategy.
  Assessment rigor: 1
  Origin: 53A_R5_CA-07[02]
• CPL-07_A04 the frequency of cybersecurity / data privacy control assessments is defined.
  Defined parameters: at least every 12 months and after any significant incidents or significant changes occur
  Assessment rigor: 2
  Origin: 171A_3.12.1[a] 53A_R5_CA-07_ODP[02] 53A_R5_CA-07_ODP[03] 53A_R5_CA-07b.[01] 53A_R5_CA-07b.[02]
• CPL-07_A05 cybersecurity / data privacy controls are assessed with the defined frequency to determine if the controls are effective in their application.
  Defined parameters: at least annually
  Assessment rigor: 2
  Origin: 171A_3.12.1[b] 53A_R5_CA-07c.
• CPL-07_A06 cybersecurity / data privacy controls are monitored on an ongoing basis to ensure the continued effectiveness of those controls.
  Assessment rigor: 2
  Origin: 171A_3.12.3
• CPL-07_A07 personnel or roles to whom the cybersecurity / data privacy status of the system is reported are defined.
  Assessment rigor: 3
  Origin: 53A_R5_CA-07_ODP[04] 53A_R5_CA-07_ODP[06]
• CPL-07_A08 the frequency at which the cybersecurity / data privacy status of the system is reported is defined.
  Defined parameters: at least annually
  Assessment rigor: 3
  Origin: 53A_R5_CA-07_ODP[05] 53A_R5_CA-07_ODP[07]
• CPL-07_A09 system-level continuous monitoring includes reporting the cybersecurity / data privacy status of the system to pertinent personnel or roles according to an organization-defined frequency.
  Defined parameters: at least monthly
  Assessment rigor: 3
  Origin: 53A_R5_CA-07g.[01] 53A_R5_CA-07g.[02]
• CPL-07_A10 control monitoring metrics are defined.
  Assessment rigor: 3
  Origin: 53A_R5_CA-07_ODP[01] 53A_R5_CA-07a.
• CPL-07_A11 system-level continuous monitoring includes ongoing monitoring of system and organization-defined metrics in accordance with the continuous monitoring strategy.
  Assessment rigor: 3
  Origin: 53A_R5_CA-07d.
• CPL-07_A12 system-level continuous monitoring includes correlation and analysis of information generated by control assessments and monitoring.
  Assessment rigor: 3
  Origin: 53A_R5_CA-07e.
• CPL-07_A13 system-level continuous monitoring includes response actions to address the results of the analysis of control assessment and monitoring information.
  Assessment rigor: 3
  Origin: 53A_R5_CA-07f.
• CPL-07_A14 the personnel or roles for reporting the security status of organizational systems to is/are defined.
  Assessment rigor: 3
  Origin: 53A_R5_PM-31_ODP[04]
• CPL-07_A15 the personnel or roles for reporting the privacy status of organizational systems to is/are defined.
  Assessment rigor: 3
  Origin: 53A_R5_PM-31_ODP[05]
• CPL-07_A16 the frequency at which to report the security status of organizational systems is defined.
  Defined parameters: at least quarterly
  Assessment rigor: 3
  Origin: 53A_R5_PM-31_ODP[06]
• CPL-07_A17 the frequency at which to report the privacy status of organizational systems is defined.
  Defined parameters: at least quarterly
  Assessment rigor: 3
  Origin: 53A_R5_PM-31_ODP[07]
• CPL-07_A18 an organization-wide continuous monitoring strategy is developed.
  Assessment rigor: 3
  Origin: 53A_R5_PM-31 53A_R5_PM-31_ODP[01]
• CPL-07_A19 continuous monitoring programs are implemented that include establishing metrics to be monitored.
  Assessment rigor: 3
  Origin: 53A_R5_PM-31a.
• CPL-07_A20 continuous monitoring programs are implemented that establish frequency for monitoring.
  Defined parameters: at least monthly
  Assessment rigor: 3
  Origin: 53A_R5_PM-31b.[01] 53A_R5_PM-31_ODP[02]
• CPL-07_A21 continuous monitoring programs are implemented that establish frequency for assessment of control effectiveness.
  Defined parameters: at least annually
  Assessment rigor: 3
  Origin: 53A_R5_PM-31b.[02] 53A_R5_PM-31_ODP[03]
• CPL-07_A22 continuous monitoring programs are implemented that include monitoring metrics on an ongoing basis in accordance with the continuous monitoring strategy.
  Assessment rigor: 3
  Origin: 53A_R5_PM-31c.
• CPL-07_A23 continuous monitoring programs are implemented that include correlating information generated by control assessments and monitoring.
  Assessment rigor: 3
  Origin: 53A_R5_PM-31d.[01]
• CPL-07_A24 continuous monitoring programs are implemented that include analyzing information generated by control assessments and monitoring.
  Assessment rigor: 3
  Origin: 53A_R5_PM-31d.[02]
• CPL-07_A25 continuous monitoring programs are implemented that include response actions to address the analysis of control assessment information.
  Assessment rigor: 3
  Origin: 53A_R5_PM-31e.[01]
• CPL-07_A26 continuous monitoring programs are implemented that include response actions to address the analysis of monitoring information.
  Assessment rigor: 3
  Origin: 53A_R5_PM-31e.[02]
• CPL-07_A27 continuous monitoring programs are implemented that include reporting the security status of organizational systems to personnel or roles frequency.
  Defined parameters: at least quarterly
  Assessment rigor: 3
  Origin: 53A_R5_PM-31f.[01]
• CPL-07_A28 continuous monitoring programs are implemented that include reporting the privacy status of organizational systems to personnel or roles frequency.
  Defined parameters: at least quarterly
  Assessment rigor: 3
  Origin: 53A_R5_PM-31f.[02]
• CPL-07_A29 a system-level continuous monitoring strategy is developed.
  Assessment rigor: 2
  Origin: 171A_R3_A.03.12.03[01]
• CPL-07_A30 ongoing monitoring is included in the continuous monitoring strategy.
  Assessment rigor: 2
  Origin: 171A_R3_A.03.12.03[03]
• CPL-07_A31 security assessments are included in the continuous monitoring strategy.
  Assessment rigor: 2
  Origin: 171A_R3_A.03.12.03[04]

Свързани задачи

• Secure Controls Framework -

  EN: GRCA includes the Secure Controls Framework® (SCF) content, © Secure Controls Framework Council, LLC, used under the Creative Commons Attribution-NoDerivatives 4.0 International Public License. SCF control numbers, names, descriptions and mappings appear exactly as published by the SCF Council – https://securecontrolsframework.com. GRCA may group or reorder SCF content for display, which does not change SCF content; the mappings are shown as links to the frameworks they name. Learn more at https://securecontrolsframework.com.

  DE: GRCA enthält Inhalte des Secure Controls Framework® (SCF), © Secure Controls Framework Council, LLC, genutzt unter der Creative Commons Attribution-NoDerivatives 4.0 International Public License. Nummern, Namen, Beschreibungen und Zuordnungen der SCF-Controls erscheinen genau so, wie der SCF Council sie veröffentlicht – https://securecontrolsframework.com. GRCA gruppiert oder sortiert SCF-Inhalte für die Anzeige, ohne sie zu verändern; die Zuordnungen erscheinen als Verknüpfungen zu den genannten Regelwerken. Mehr unter https://securecontrolsframework.com.