+CM-03(04) Security and Privacy Representatives
|
CM-03(04) Security and Privacy Representatives
Control
Require [Assignement: organization-defined security and privacy representatives] to be members of the [Assignement: configuration change control element].
Discussion
Information security and privacy representatives include system security officers, senior agency information security officers, senior agency officials for privacy, or system privacy officers. Representation by personnel with information security and privacy expertise is important because changes to system configurations can have unintended side effects, some of which may be security- or privacy-relevant. Detecting such changes early in the process can help avoid unintended, negative consequences that could ultimately affect the security and privacy posture of systems. The configuration change control element referred to in the second organization-defined parameter reflects the change control elements defined by organizations in [CM-3g](#cm-3_smt.g).
Assessment Objective
- [Assignement: security representatives] are required to be members of the [Assignement: configuration change control element];
- [Assignement: privacy representatives] are required to be members of the [Assignement: configuration change control element].
Assessment Method
Examine
Configuration management policy
procedures addressing system configuration change control
configuration management plan
system security plan
privacy plan
other relevant documents or records
Interview
Organizational personnel with configuration change control responsibilities
organizational personnel with information security and privacy responsibilities
members of change control board or similar
1. Přehled
1.1 Odkazy
1.2 Identifikované požadavky
1.3 Související regulace
2. Identifikované požadavky
Požadavky
| Zdroj |
Požadavek |
3. Související regulace
Propojené úkoly
|