Assessment Objective
Determine if:
- CA-02a. an appropriate assessor or assessment team is selected for the type of assessment to be conducted;
- CA-02b.
- CA-02b.01 a control assessment plan is developed that describes the scope of the assessment, including controls and control enhancements under assessment;
- CA-02b.02 a control assessment plan is developed that describes the scope of the assessment, including assessment procedures to be used to determine control effectiveness;
- CA-02b.03
- CA-02b.03[01] a control assessment plan is developed that describes the scope of the assessment, including the assessment environment;
- CA-02b.03[02] a control assessment plan is developed that describes the scope of the assessment, including the assessment team;
- CA-02b.03[03] a control assessment plan is developed that describes the scope of the assessment, including assessment roles and responsibilities;
- CA-02c. the control assessment plan is reviewed and approved by the authorizing official or designated representative prior to conducting the assessment;
- CA-02d.
- CA-02d.[01] controls are assessed in the system and its environment of operation [Assignment: assessment frequency] to determine the extent to which the controls are implemented correctly, operating as intended, and producing the desired outcome with respect to meeting established security requirements;
- CA-02d.[02] controls are assessed in the system and its environment of operation [Assignment: assessment frequency] to determine the extent to which the controls are implemented correctly, operating as intended, and producing the desired outcome with respect to meeting established privacy requirements;
- CA-02e. a control assessment report is produced that documents the results of the assessment;
- CA-02f. the results of the control assessment are provided to [Assignment: individuals or roles].
Assessment Methods
Examine
- Assessment, authorization, and monitoring policy
- procedures addressing assessment planning
- procedures addressing control assessments
- control assessment plan
- control assessment report
- system security plan
- privacy plan
- other relevant documents or records
Interview
- Organizational personnel with control assessment responsibilities
- organizational personnel with information security and privacy responsibilities
Test
- Mechanisms supporting control assessment, control assessment plan development, and/or control assessment reporting
Propojené úkoly
| Typ vazby | Úkol |
|---|---|
| blocks | CA-02 Control Assessments |