Assessment Objectives
In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that:
- OPS-04_A01 procedures needed to satisfy the security requirements for the protection of sensitive / regulated data are developed and documented.
Assessment rigor: 1
Origin: 53A_R5_AC-01a.[03] 53A_R5_AT-01a.[03] 53A_R5_AU-01a.[03] 53A_R5_CA-01a.[03] 53A_R5_CM-01a.[03] 53A_R5_CP-01a.[03] 53A_R5_IA-01a.[03] 53A_R5_IR-01a.[03] 53A_R5_MA-01a.[03] 53A_R5_MP-01a.[03] 53A_R5_PE-01a.[03] 53A_R5_PL-01a.[03] 53A_R5_PS-01a.[03] 53A_R5_PT-01a.[03] 53A_R5_RA-01a.[03] 53A_R5_SA-01a.[03] 53A_R5_SC-01a.[03] 53A_R5_SI-01a.[03] 53A_R5_SR-01a.[03] - OPS-04_A02 procedures needed to satisfy the security requirements for the protection of sensitive / regulated data are disseminated to organizational personnel or roles.
Assessment rigor: 1
Origin: 53A_R5_AC-01a.[04] 53A_R5_AT-01a.[04] 53A_R5_AU-01a.[04] 53A_R5_CA-01a.[04] 53A_R5_CM-01a.[04] 53A_R5_CP-01a.[04] 53A_R5_IA-01a.[04] 53A_R5_IR-01a.[04] 53A_R5_MA-01a.[04] 53A_R5_MP-01a.[04] 53A_R5_PE-01a.[04] 53A_R5_PL-01a.[04] 53A_R5_PS-01a.[04] 53A_R5_PT-01a.[04] 53A_R5_RA-01a.[04] 53A_R5_SA-01a.[04] 53A_R5_SC-01a.[04] 53A_R5_SI-01a.[04] 53A_R5_SR-01a.[04] - OPS-04_A03 the current cybersecurity / data privacy procedures are reviewed / updated frequently.
Defined parameters: Review policies, standards and procedures at least annual and following significant changes
Assessment rigor: 3
Origin: 53A_R5_AC-01c.02[01] 53A_R5_AT-01c.02[01] 53A_R5_AU-01c.02[01] 53A_R5_CA-01c.02[01] 53A_R5_CM-01c.02[01] 53A_R5_CP-01c.02[01] 53A_R5_IA-01c.02[01] 53A_R5_IR-01c.02[01] 53A_R5_MA-01c.02[01] 53A_R5_MP-01c.02[01] 53A_R5_PE-01c.02[01] 53A_R5_PL-01c.02[01] 53A_R5_PS-01c.02[01] 53A_R5_PT-01c.02[01] 53A_R5_RA-01c.02[01] 53A_R5_SA-01c.02[01] 53A_R5_SC-01c.02[01] 53A_R5_SI-01c.02[01] 53A_R5_SR-01c.02[01] - OPS-04_A04 the current cybersecurity / data privacy procedures are reviewed / updated following events.
Defined parameters: Review policies, standards and procedures at least annual and following significant changes
Assessment rigor: 3
Origin: 53A_R5_AC-01c.02[02] 53A_R5_AT-01c.02[02] 53A_R5_AU-01c.02[02] 53A_R5_CA-01c.02[02] 53A_R5_CM-01c.02[02] 53A_R5_CP-01c.02[02] 53A_R5_IA-01c.02[02] 53A_R5_IR-01c.02[02] 53A_R5_MA-01c.02[02] 53A_R5_MP-01c.02[02] 53A_R5_PE-01c.02[02] 53A_R5_PL-01c.02[02] 53A_R5_PS-01c.02[02] 53A_R5_PT-01c.02[02] 53A_R5_RA-01c.02[02] 53A_R5_SA-01c.02[02] 53A_R5_SC-01c.02[02] 53A_R5_SI-01c.02[02] 53A_R5_SR-01c.02[02] - OPS-04_A05 personnel or roles to whom cybersecurity / data privacy procedures are to be disseminated is/are defined.
Assessment rigor: 3
Origin: 53A_R5_AC-01_ODP[02] 53A_R5_AT-01_ODP[02] 53A_R5_AU-01_ODP[02] 53A_R5_CA-01_ODP[02] 53A_R5_CM-01_ODP[02] 53A_R5_CP-01_ODP[02] 53A_R5_IA-01_ODP[02] 53A_R5_IR-01_ODP[02] 53A_R5_MA-01_ODP[02] 53A_R5_MP-01_ODP[02] 53A_R5_PE-01_ODP[02] 53A_R5_PL-01_ODP[02] 53A_R5_PS-01_ODP[02] 53A_R5_PT-01_ODP[02] 53A_R5_RA-01_ODP[02] 53A_R5_SA-01_ODP[02] 53A_R5_SC-01_ODP[02] 53A_R5_SI-01_ODP[02] 53A_R5_SR-01_ODP[02] - OPS-04_A06 events that would require procedures to be reviewed / updated are defined.
Assessment rigor: 3
Origin: 53A_R5_AC-01_ODP[08] 53A_R5_AT-01_ODP[08] 53A_R5_AU-01_ODP[08] 53A_R5_CA-01_ODP[08] 53A_R5_CM-01_ODP[08] 53A_R5_CP-01_ODP[08] 53A_R5_IA-01_ODP[08] 53A_R5_IR-01_ODP[08] 53A_R5_MA-01_ODP[08] 53A_R5_MP-01_ODP[08] 53A_R5_PE-01_ODP[08] 53A_R5_PL-01_ODP[08] 53A_R5_PS-01_ODP[08] 53A_R5_PT-01_ODP[08] 53A_R5_RA-01_ODP[08] 53A_R5_SA-01_ODP[08] 53A_R5_SC-01_ODP[08] 53A_R5_SI-01_ODP[08] 53A_R5_SR-01_ODP[08] - OPS-04_A07 systems or system components that implement the security design principle of sufficient documentation are defined.
Assessment rigor: 3
Origin: 53A_R5_SA-08(32)_ODP - OPS-04_A08 systems or system components implement the security design principle of sufficient documentation.
Assessment rigor: 3
Origin: 53A_R5_SA-08(32) - OPS-04_A09 policies and procedures are reviewed per an organization-defined frequency.
Defined parameters: at least annually
Assessment rigor: 3
Origin: 53A_R5_AC-01_ODP[07] 53A_R5_AT-01_ODP[07] 53A_R5_AU-01_ODP[07] 53A_R5_CA-01_ODP[07] 53A_R5_CM-01_ODP[07] 53A_R5_CP-01_ODP[07] 53A_R5_IA-01_ODP[07] 53A_R5_IR-01_ODP[07] 53A_R5_MA-01_ODP[07] 53A_R5_MP-01_ODP[07] 53A_R5_PE-01_ODP[07] 53A_R5_PL-01_ODP[07] 53A_R5_PS-01_ODP[07] 53A_R5_PT-01_ODP[07] 53A_R5_RA-01_ODP[07] 53A_R5_SA-01_ODP[07] 53A_R5_SC-01_ODP[07] 53A_R5_SI-01_ODP[07] 53A_R5_SR-01_ODP[07] - OPS-04_A10 policies and procedures are updated per an organization-defined frequency.
Defined parameters: at least annually
Assessment rigor: 3
Origin: 53A_R5_AC-01_ODP[07] 53A_R5_AT-01_ODP[07] 53A_R5_AU-01_ODP[07] 53A_R5_CA-01_ODP[07] 53A_R5_CM-01_ODP[07] 53A_R5_CP-01_ODP[07] 53A_R5_IA-01_ODP[07] 53A_R5_IR-01_ODP[07] 53A_R5_MA-01_ODP[07] 53A_R5_MP-01_ODP[07] 53A_R5_PE-01_ODP[07] 53A_R5_PL-01_ODP[07] 53A_R5_PS-01_ODP[07] 53A_R5_PT-01_ODP[07] 53A_R5_RA-01_ODP[07] 53A_R5_SA-01_ODP[07] 53A_R5_SC-01_ODP[07] 53A_R5_SI-01_ODP[07] 53A_R5_SR-01_ODP[07] - OPS-04_A11 procedures needed to satisfy the security requirements for the protection of CUI are developed and documented.
Assessment rigor: NIST 800-171
Origin: 171A_R3_A.03.15.01.a[03] - OPS-04_A12 procedures needed to satisfy the security requirements for the protection of CUI are disseminated to organizational personnel or roles.
Assessment rigor: NIST 800-171
Origin: 171A_R3_A.03.15.01.a[04] - OPS-04_A13 policies and procedures are reviewed <A.03.15.01.ODP[01]: frequency>.
Defined parameters: at least every 12 months, or when there are significant incidents or significant changes to risks
Assessment rigor: NIST 800-171
Origin: 171A_R3_A.03.15.01.b[01] - OPS-04_A14 policies and procedures are updated <A.03.15.01.ODP[01]: frequency>.
Defined parameters: at least every 12 months, or when there are significant incidents or significant changes to risks
Assessment rigor: NIST 800-171
Origin: 171A_R3_A.03.15.01.b[02]
Propojené úkoly
| Typ vazby | Úkol |
|---|---|
| blocks | Standardized Operating Procedures (SOP) |
- Secure Controls Framework -
EN: GRCA includes the Secure Controls Framework® (SCF) content, © Secure Controls Framework Council, LLC, used under the Creative Commons Attribution-NoDerivatives 4.0 International Public License. SCF control numbers, names, descriptions and mappings appear exactly as published by the SCF Council – https://securecontrolsframework.com. GRCA may group or reorder SCF content for display, which does not change SCF content; the mappings are shown as links to the frameworks they name. Learn more at https://securecontrolsframework.com.
DE: GRCA enthält Inhalte des Secure Controls Framework® (SCF), © Secure Controls Framework Council, LLC, genutzt unter der Creative Commons Attribution-NoDerivatives 4.0 International Public License. Nummern, Namen, Beschreibungen und Zuordnungen der SCF-Controls erscheinen genau so, wie der SCF Council sie veröffentlicht – https://securecontrolsframework.com. GRCA gruppiert oder sortiert SCF-Inhalte für die Anzeige, ohne sie zu verändern; die Zuordnungen erscheinen als Verknüpfungen zu den genannten Regelwerken. Mehr unter https://securecontrolsframework.com.