Assessment Objectives

In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that:

• GOV-04.1_A01 the frequency at which the policies and procedures for satisfying security requirements are reviewed and updated is defined.
  Defined parameters: at least annually
  Assessment rigor: 1
  Origin: 171A_R3_A.03.15.01.ODP[01] 53A_R5_AC-01_ODP[05] 53A_R5_AT-01_ODP[05] 53A_R5_AU-01_ODP[05] 53A_R5_CA-01_ODP[05] 53A_R5_CM-01_ODP[05] 53A_R5_CP-01_ODP[05] 53A_R5_IA-01_ODP[05] 53A_R5_IR-01_ODP[05] 53A_R5_MA-01_ODP[05] 53A_R5_MP-01_ODP[05] 53A_R5_PE-01_ODP[05] 53A_R5_PL-01_ODP[05] 53A_R5_PS-01_ODP[05] 53A_R5_PT-01_ODP[05] 53A_R5_RA-01_ODP[05] 53A_R5_SA-01_ODP[05] 53A_R5_SC-01_ODP[05] 53A_R5_SI-01_ODP[05] 53A_R5_SR-01_ODP[05]
• GOV-04.1_A02 policies and procedures are reviewed / updated per an organization-defined frequency.
  Defined parameters: Review policies, standards and procedures at least annual and following significant changes
  Assessment rigor: 1
  Origin: 53A_R5_AC-01c.01[01] 53A_R5_AC-01c.01[02] 53A_R5_AT-01c.01[01] 53A_R5_AT-01c.01[02] 53A_R5_AU-01c.01[01] 53A_R5_AU-01c.01[02] 53A_R5_CA-01c.01[01] 53A_R5_CA-01c.01[02] 53A_R5_CM-01c.01[01] 53A_R5_CM-01c.01[02] 53A_R5_CP-01c.01[01] 53A_R5_CP-01c.01[02] 53A_R5_IA-01c.01[01] 53A_R5_IA-01c.01[02] 53A_R5_IR-01c.01[01] 53A_R5_IR-01c.01[02] 53A_R5_MA-01c.01[01] 53A_R5_MA-01c.01[02] 53A_R5_MP-01c.01[01] 53A_R5_MP-01c.01[02] 53A_R5_PE-01c.01[01] 53A_R5_PE-01c.01[02] 53A_R5_PL-01c.01[01] 53A_R5_PL-01c.01[02] 53A_R5_PS-01c.01[01] 53A_R5_PS-01c.01[02] 53A_R5_PT-01c.01[01] 53A_R5_PT-01c.01[02] 53A_R5_RA-01c.01[01] 53A_R5_RA-01c.01[02] 53A_R5_SA-01c.01[01] 53A_R5_SA-01c.01[02] 53A_R5_SC-01c.01[01] 53A_R5_SC-01c.01[02] 53A_R5_SI-01c.01[01] 53A_R5_SI-01c.01[02] 53A_R5_SR-01c.01[01] 53A_R5_SR-01c.01[02]
• GOV-04.1_A03 events that would require the current cybersecurity / data privacy policies to be reviewed / updated are defined.
  Defined parameters: significant changes
  Assessment rigor: 3
  Origin: 53A_R5_AC-01_ODP[06] 53A_R5_AT-01_ODP[06] 53A_R5_AU-01_ODP[06] 53A_R5_CA-01_ODP[06] 53A_R5_CM-01_ODP[06] 53A_R5_CP-01_ODP[06] 53A_R5_IA-01_ODP[06] 53A_R5_IR-01_ODP[06] 53A_R5_MA-01_ODP[06] 53A_R5_MP-01_ODP[06] 53A_R5_PE-01_ODP[06] 53A_R5_PL-01_ODP[06] 53A_R5_PS-01_ODP[06] 53A_R5_PT-01_ODP[06] 53A_R5_RA-01_ODP[06] 53A_R5_SA-01_ODP[06] 53A_R5_SC-01_ODP[06] 53A_R5_SI-01_ODP[06] 53A_R5_SR-01_ODP[06]
• GOV-04.1_A04 policies and procedures are reviewed <A.03.15.01.ODP[01]: frequency>.
  Defined parameters: at least every 12 months, or when there are significant incidents or significant changes to risks
  Assessment rigor: NIST 800-171
  Origin: 171A_R3_A.03.15.01.b[01]
• GOV-04.1_A05 policies and procedures are updated <A.03.15.01.ODP[01]: frequency>.
  Defined parameters: at least every 12 months, or when there are significant incidents or significant changes to risks
  Assessment rigor: NIST 800-171
  Origin: 171A_R3_A.03.15.01.b[02]

Propojené úkoly

• Secure Controls Framework -

  EN: GRCA includes the Secure Controls Framework® (SCF) content, © Secure Controls Framework Council, LLC, used under the Creative Commons Attribution-NoDerivatives 4.0 International Public License. SCF control numbers, names, descriptions and mappings appear exactly as published by the SCF Council – https://securecontrolsframework.com. GRCA may group or reorder SCF content for display, which does not change SCF content; the mappings are shown as links to the frameworks they name. Learn more at https://securecontrolsframework.com.

  DE: GRCA enthält Inhalte des Secure Controls Framework® (SCF), © Secure Controls Framework Council, LLC, genutzt unter der Creative Commons Attribution-NoDerivatives 4.0 International Public License. Nummern, Namen, Beschreibungen und Zuordnungen der SCF-Controls erscheinen genau so, wie der SCF Council sie veröffentlicht – https://securecontrolsframework.com. GRCA gruppiert oder sortiert SCF-Inhalte für die Anzeige, ohne sie zu verändern; die Zuordnungen erscheinen als Verknüpfungen zu den genannten Regelwerken. Mehr unter https://securecontrolsframework.com.