+SA-04(08) Continuous Monitoring Plan for Controls

SA-04(08) Continuous Monitoring Plan for Controls

Control

Require the developer of the system, system component, or system service to produce a plan for continuous monitoring of control effectiveness that is consistent with the continuous monitoring program of the organization.

Discussion

The objective of continuous monitoring plans is to determine if the planned, required, and deployed controls within the system, system component, or system service continue to be effective over time based on the inevitable changes that occur. Developer continuous monitoring plans include a sufficient level of detail such that the information can be incorporated into continuous monitoring programs implemented by organizations. Continuous monitoring plans can include the types of control assessment and monitoring activities planned, frequency of control monitoring, and actions to be taken when controls fail or become ineffective.

Assessment Objective

the developer of the system, system component, or system service is required to produce a plan for the continuous monitoring of control effectiveness that is consistent with the continuous monitoring program of the organization.

Assessment Method

Examine

System and services acquisition policy procedures addressing developer continuous monitoring plans procedures addressing the integration of security requirements, descriptions, and criteria into the acquisition process developer continuous monitoring plans security assessment plans acquisition contracts for the system, system component, or system service acquisition documentation solicitation documentation service level agreements system security plan other relevant documents or records

Interview

Organizational personnel with acquisition/contracting responsibilities organizational personnel with the responsibility for determining system security requirements system developers organizational personnel with information security responsibilities

1. Přehled

1.1 Odkazy

1.2 Identifikované požadavky

1.3 Související regulace

2. Identifikované požadavky

Požadavky

3. Související regulace

Regulace

Propojené úkoly

Vazby
is blocked by SA-04(08) Continuous Monitoring Plan for Controls – Assessment Procedure
is blocked by Continuous Monitoring Plan