+SA-09(01) Risk Assessments and Organizational Approvals
|
SA-09(01) Risk Assessments and Organizational Approvals
Control
- Conduct an organizational assessment of risk prior to the acquisition or outsourcing of information security services; and
- Verify that the acquisition or outsourcing of dedicated information security services is approved by [Assignement: personnel or roles].
Discussion
Information security services include the operation of security devices, such as firewalls or key management services as well as incident monitoring, analysis, and response. Risks assessed can include system, mission or business, security, privacy, or supply chain risks.
Assessment Objective
- an organizational assessment of risk is conducted prior to the acquisition or outsourcing of information security services;
- [Assignement: personnel or roles] approve the acquisition or outsourcing of dedicated information security services.
Assessment Method
Examine
System and services acquisition policy
supply chain risk management policy and procedures
procedures addressing external system services
acquisition documentation
acquisition contracts for the system, system component, or system service
risk assessment reports
approval records for the acquisition or outsourcing of dedicated security services
system security plan
supply chain risk management plan
other relevant documents or records
Interview
Organizational personnel with system and service acquisition responsibilities
organizational personnel with system security responsibilities
external providers of system services
organizational personnel with information security responsibilities
organizational personnel with supply chain risk management responsibilities
1. Přehled
1.1 Odkazy
1.2 Identifikované požadavky
1.3 Související regulace
2. Identifikované požadavky
Požadavky
| Zdroj |
Požadavek |
3. Související regulace
Propojené úkoly
|