+PM-06 Measures of Performance
|
PM-06 Measures of Performance
Control
Develop, monitor, and report on the results of information security and privacy measures of performance.
Discussion
Measures of performance are outcome-based metrics used by an organization to measure the effectiveness or efficiency of the information security and privacy programs and the controls employed in support of the program. To facilitate security and privacy risk management, organizations consider aligning measures of performance with the organizational risk tolerance as defined in the risk management strategy.
Assessment Objective
- information security measures of performance are developed;
- information security measures of performance are monitored;
- the results of information security measures of performance are reported;
- privacy measures of performance are developed;
- privacy measures of performance are monitored;
- the results of privacy measures of performance are reported.
Assessment Method
Examine
Information security program plan
privacy program plan
information security measures of performance
privacy measures of performance
procedures addressing the development, monitoring, and reporting of information security and privacy measures of performance
risk management strategy
other relevant documents or records
Interview
Organizational personnel with information security and privacy program planning and plan implementation responsibilities
organizational personnel responsible for developing, monitoring, and reporting information security and privacy measures of performance
organizational personnel with information security and privacy responsibilities
1. Přehled
1.1 Odkazy
1.2 Identifikované požadavky
1.3 Související regulace
2. Identifikované požadavky
Požadavky
| Zdroj |
Požadavek |
3. Související regulace
Propojené úkoly
|