+CM-04 Impact Analyses
---+CM-04(01) Separate Test Environments
---+CM-04(02) Verification of Controls

CM-04 Impact Analyses

Control

Analyze changes to the system to determine potential security and privacy impacts prior to change implementation.

Discussion

Organizational personnel with security or privacy responsibilities conduct impact analyses. Individuals conducting impact analyses possess the necessary skills and technical expertise to analyze the changes to systems as well as the security or privacy ramifications. Impact analyses include reviewing security and privacy plans, policies, and procedures to understand control requirements; reviewing system design documentation and operational procedures to understand control implementation and how specific system changes might affect the controls; reviewing the impact of changes on organizational supply chain partners with stakeholders; and determining how potential changes to a system create new risks to the privacy of individuals and the ability of implemented controls to mitigate those risks. Impact analyses also include risk assessments to understand the impact of the changes and determine if additional controls are required.

Assessment Objective

  1. changes to the system are analyzed to determine potential security impacts prior to change implementation;
  2. changes to the system are analyzed to determine potential privacy impacts prior to change implementation.

Assessment Method

Examine

Configuration management policy procedures addressing security impact analyses for changes to the system procedures addressing privacy impact analyses for changes to the system configuration management plan security impact analysis documentation privacy impact analysis documentation privacy impact assessment privacy risk assessment documentation, system design documentation analysis tools and associated outputs change control records system audit records system security plan privacy plan other relevant documents or records

Interview

Organizational personnel with responsibility for conducting security impact analyses organizational personnel with responsibility for conducting privacy impact analyses organizational personnel with information security and privacy responsibilities system developer system/network administrators members of change control board or similar

1. Přehled

CM-04(01) Separate Test Environments

Control

Analyze changes to the system in a separate test environment before implementation in an operational environment, looking for security and privacy impacts due to flaws, weaknesses, incompatibility, or intentional malice.

Discussion

A separate test environment requires an environment that is physically or logically separate and distinct from the operational environment. The separation is sufficient to ensure that activities in the test environment do not impact activities in the operational environment and that information in the operational environment is not inadvertently transmitted to the test environment. Separate environments can be achieved by physical or logical means. If physically separate test environments are not implemented, organizations determine the strength of mechanism required when implementing logical separation.

Assessment Objective

  1. changes to the system are analyzed in a separate test environment before implementation in an operational environment;
  2. changes to the system are analyzed for security impacts due to flaws;
  3. changes to the system are analyzed for privacy impacts due to flaws;
  4. changes to the system are analyzed for security impacts due to weaknesses;
  5. changes to the system are analyzed for privacy impacts due to weaknesses;
  6. changes to the system are analyzed for security impacts due to incompatibility;
  7. changes to the system are analyzed for privacy impacts due to incompatibility;
  8. changes to the system are analyzed for security impacts due to intentional malice;
  9. changes to the system are analyzed for privacy impacts due to intentional malice.

Assessment Method

Examine

Configuration management policy procedures addressing security impact analyses for changes to the system procedures addressing privacy impact analyses for changes to the system configuration management plan security impact analysis documentation privacy impact analysis documentation privacy impact assessment privacy risk assessment documentation analysis tools and associated outputs system design documentation system architecture and configuration documentation change control records procedures addressing the authority to test with PII system audit records documentation of separate test and operational environments system security plan privacy plan other relevant documents or records

Interview

Organizational personnel with responsibility for conducting security and privacy impact analyses organizational personnel with information security and privacy responsibilities system/network administrators members of change control board or similar
CM-04(02) Verification of Controls

Control

After system changes, verify that the impacted controls are implemented correctly, operating as intended, and producing the desired outcome with regard to meeting the security and privacy requirements for the system.

Discussion

Implementation in this context refers to installing changed code in the operational system that may have an impact on security or privacy controls.

Assessment Objective

  1. the impacted controls are implemented correctly with regard to meeting the security requirements for the system after system changes;
  2. the impacted controls are implemented correctly with regard to meeting the privacy requirements for the system after system changes;
  3. the impacted controls are operating as intended with regard to meeting the security requirements for the system after system changes;
  4. the impacted controls are operating as intended with regard to meeting the privacy requirements for the system after system changes;
  5. the impacted controls are producing the desired outcome with regard to meeting the security requirements for the system after system changes;
  6. the impacted controls are producing the desired outcome with regard to meeting the privacy requirements for the system after system changes.

Assessment Method

Examine

Configuration management policy procedures addressing security impact analyses for changes to the system procedures addressing privacy impact analyses for changes to the system privacy risk assessment documentation configuration management plan security and privacy impact analysis documentation privacy impact assessment analysis tools and associated outputs change control records control assessment results system audit records system component inventory system security plan privacy plan other relevant documents or records

Interview

Organizational personnel with responsibility for conducting security and privacy impact analyses organizational personnel with information security and privacy responsibilities system/network administrators security and privacy assessors

1.1 Odkazy

1.2 Identifikované požadavky

1.3 Související regulace

2. Identifikované požadavky

Požadavky

3. Související regulace

Regulace

Propojené úkoly

Vazby
is blocked by CM-04 Impact Analyses – Assessment Procedure
is blocked by Security Impact Analysis for Changes
  • NIST -

    EN: Publications of the National Institute of Standards and Technology (NIST), U.S. Department of Commerce, https://www.nist.gov/, from their electronic versions (OSCAL; SP 800-63-4 from its HTML version, https://pages.nist.gov/800-63-4/). Works of NIST employees are not subject to copyright protection in the United States (17 U.S.C. § 105); the OSCAL content is dedicated to the public domain worldwide (CC0 1.0); outside the United States NIST grants the right to reprint its technical series publications in all formats (NIST copyright statement). Republished courtesy of the National Institute of Standards and Technology; each document names its citation. Divided into sections and converted into the GRCA format, the wording unchanged. Only the versions published by NIST are authoritative.

    DE: Veröffentlichungen des National Institute of Standards and Technology (NIST), U.S. Department of Commerce, https://www.nist.gov/, aus ihren elektronischen Fassungen (OSCAL; SP 800-63-4 aus ihrer HTML-Fassung, https://pages.nist.gov/800-63-4/). Werke von NIST-Beschäftigten sind in den USA urheberrechtlich nicht geschützt (17 U.S.C. § 105); die OSCAL-Inhalte sind weltweit gemeinfrei gestellt (CC0 1.0); außerhalb der USA räumt das NIST das Recht ein, seine Technical-Series-Publikationen in allen Formaten neu zu veröffentlichen (Copyright-Hinweis des NIST). „Republished courtesy of the National Institute of Standards and Technology“; jedes Dokument nennt seine Zitierangabe. In Abschnitte aufgeteilt und in das GRCA-Format umgewandelt, der Wortlaut unverändert. Maßgeblich sind allein die vom NIST veröffentlichten Fassungen.