+CA-07(03) Trend Analyses
|
CA-07(03) Trend Analyses
Control
Employ trend analyses to determine if control implementations, the frequency of continuous monitoring activities, and the types of activities used in the continuous monitoring process need to be modified based on empirical data.
Discussion
Trend analyses include examining recent threat information that addresses the types of threat events that have occurred in the organization or the Federal Government, success rates of certain types of attacks, emerging vulnerabilities in technologies, evolving social engineering techniques, the effectiveness of configuration settings, results from multiple control assessments, and findings from Inspectors General or auditors.
Assessment Objective
- trend analysis is employed to determine if control implementations used in the continuous monitoring process need to be modified based on empirical data;
- trend analysis is employed to determine if the frequency of continuous monitoring activities used in the continuous monitoring process needs to be modified based on empirical data;
- trend analysis is employed to determine if the types of activities used in the continuous monitoring process need to be modified based on empirical data.
Assessment Method
Examine
Organizational continuous monitoring strategy
system-level continuous monitoring strategy
assessment, authorization, and monitoring policy
procedures addressing continuous monitoring of system controls
privacy controls
assessment report
plan of action and milestones
system monitoring records
impact analyses
status reports
system security plan
privacy plan
other relevant documents or records
Interview
Organizational personnel with continuous monitoring responsibilities
organizational personnel with information security and privacy responsibilities
1. Přehled
1.1 Odkazy
1.2 Identifikované požadavky
1.3 Související regulace
2. Identifikované požadavky
Požadavky
| Zdroj |
Požadavek |
3. Související regulace
Propojené úkoly
|