Assessment Objective

Determine if:

• PL-07a. a CONOPS for the system describing how the organization intends to operate the system from the perspective of information security and privacy is developed;
• PL-07b. the CONOPS is reviewed and updated [Assignment: frequency].

Assessment Methods

Examine

• Security and privacy planning policy
• procedures addressing security and privacy CONOPS development
• procedures addressing security and privacy CONOPS reviews and updates
• security and privacy CONOPS for the system
• system security plan
• privacy plan
• records of security and privacy CONOPS reviews and updates
• other relevant documents or records

Interview

• Organizational personnel with security and privacy planning and plan implementation responsibilities
• organizational personnel with information security and privacy responsibilities

Test

• Organizational processes for developing, reviewing, and updating the security CONOPS
• mechanisms supporting and/or implementing the development, review, and update of the security CONOPS

Свързани задачи

• NIST -

  https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final