Assessment Objective
Determine if:
- a security architecture for the system that describes the requirements and approach to be taken for protecting the confidentiality, integrity, and availability of CUI is developed.
- a security architecture for the system that describes how the security architecture is integrated into and supports the enterprise architecture is developed.
- a security architecture for the system that describes any assumptions about and dependencies on external systems and services is developed.
- the security architecture is reviewed and updated [Assignment: frequency] to reflect changes in the enterprise architecture.
- planned security architecture changes are reflected in system security plans, concept of operations, criticality analyses, organizational procedures, procurements, and acquisitions.
Assessment Methods
Examine
- Security planning policy
- procedures addressing information security architecture development
- procedures addressing information security architecture reviews and updates
- enterprise architecture documentation
- information security architecture documentation
- system security plan
- security CONOPS for the system
- records of information security architecture reviews and updates
- other relevant documents or records
Interview
- Personnel with security planning and plan implementation responsibilities
- personnel with information security responsibilities
- personnel with information security architecture development responsibilities
Test
- Mechanisms supporting and/or implementing the development, review, and update of the information security architecture
- processes for developing, reviewing, and updating the information security architecture