Assessment Objective
Determine if:
- RA-02a. the system and the information it processes, stores, and transmits are categorized;
- RA-02b. the security categorization results, including supporting rationale, are documented in the security plan for the system;
- RA-02c. the authorizing official or authorizing official designated representative reviews and approves the security categorization decision.
Assessment Methods
Examine
- Risk assessment policy
- security planning policy and procedures
- procedures addressing security categorization of organizational information and systems
- security categorization documentation
- system security plan
- privacy plan
- other relevant documents or records
Interview
- Organizational personnel with security categorization and risk assessment responsibilities
- organizational personnel with security and privacy responsibilities
Test
- Organizational processes for security categorization
Propojené úkoly
| Typ vazby | Úkol |
|---|---|
| blocks | RA-02 Security Categorization |