PM Program Management

Control

1. Develop and disseminate an organization-wide information security program plan that:
   1. Provides an overview of the requirements for the security program and a description of the security program management controls and common controls in place or planned for meeting those requirements;
   2. Includes the identification and assignment of roles, responsibilities, management commitment, coordination among organizational entities, and compliance;
   3. Reflects the coordination among organizational entities responsible for information security; and
   4. Is approved by a senior official with responsibility and accountability for the risk being incurred to organizational operations (including mission, functions, image, and reputation), organizational assets, individuals, other organizations, and the Nation;
2. Review and update the organization-wide information security program plan [Assignement: frequency] and following [Assignement: events] ; and
3. Protect the information security program plan from unauthorized disclosure and modification.

Discussion

Assessment Objective

1. 1. an organization-wide information security program plan is developed;
   2. the information security program plan is disseminated;
   3. 1. the information security program plan provides an overview of the requirements for the security program;
      2. the information security program plan provides a description of the security program management controls in place or planned for meeting those requirements;
      3. the information security program plan provides a description of the common controls in place or planned for meeting those requirements;
   4. 1. the information security program plan includes the identification and assignment of roles;
      2. the information security program plan includes the identification and assignment of responsibilities;
      3. the information security program plan addresses management commitment;
      4. the information security program plan addresses coordination among organizational entities;
      5. the information security program plan addresses compliance;
   5. the information security program plan reflects the coordination among the organizational entities responsible for information security;
   6. the information security program plan is approved by a senior official with responsibility and accountability for the risk being incurred to organizational operations (including mission, functions, image, and reputation), organizational assets, individuals, other organizations, and the Nation;
2. 1. the information security program plan is reviewed and updated [Assignement: frequency];
   2. the information security program plan is reviewed and updated following [Assignement: events];
3. 1. the information security program plan is protected from unauthorized disclosure;
   2. the information security program plan is protected from unauthorized modification.

Assessment Method

Examine

Interview

Control

Discussion

Assessment Objective

1. a senior agency information security officer is appointed;
2. the senior agency information security officer is provided with the mission and resources to coordinate an organization-wide information security program;
3. the senior agency information security officer is provided with the mission and resources to develop an organization-wide information security program;
4. the senior agency information security officer is provided with the mission and resources to implement an organization-wide information security program;
5. the senior agency information security officer is provided with the mission and resources to maintain an organization-wide information security program.

Assessment Method

Examine

Interview

Control

1. Include the resources needed to implement the information security and privacy programs in capital planning and investment requests and document all exceptions to this requirement;
2. Prepare documentation required for addressing information security and privacy programs in capital planning and investment requests in accordance with applicable laws, executive orders, directives, policies, regulations, standards; and
3. Make available for expenditure, the planned information security and privacy resources.

Discussion

Assessment Objective

1. 1. the resources needed to implement the information security program are included in capital planning and investment requests, and all exceptions are documented;
   2. the resources needed to implement the privacy program are included in capital planning and investment requests, and all exceptions are documented;
2. 1. the documentation required for addressing the information security program in capital planning and investment requests is prepared in accordance with applicable laws, executive orders, directives, policies, regulations, standards;
   2. the documentation required for addressing the privacy program in capital planning and investment requests is prepared in accordance with applicable laws, executive orders, directives, policies, regulations, standards;
3. 1. information security resources are made available for expenditure as planned;
   2. privacy resources are made available for expenditure as planned.

Assessment Method

Examine

Interview

Control

1. Implement a process to ensure that plans of action and milestones for the information security, privacy, and supply chain risk management programs and associated organizational systems:
   1. Are developed and maintained;
   2. Document the remedial information security, privacy, and supply chain risk management actions to adequately respond to risk to organizational operations and assets, individuals, other organizations, and the Nation; and
   3. Are reported in accordance with established reporting requirements.
2. Review plans of action and milestones for consistency with the organizational risk management strategy and organization-wide priorities for risk response actions.

Discussion

Assessment Objective

1. 1. 1. a process to ensure that plans of action and milestones for the information security program and associated organizational systems are developed;
      2. a process to ensure that plans of action and milestones for the information security program and associated organizational systems are maintained;
      3. a process to ensure that plans of action and milestones for the privacy program and associated organizational systems are developed;
      4. a process to ensure that plans of action and milestones for the privacy program and associated organizational systems are maintained;
      5. a process to ensure that plans of action and milestones for the supply chain risk management program and associated organizational systems are developed;
      6. a process to ensure that plans of action and milestones for the supply chain risk management program and associated organizational systems are maintained;
   2. 1. a process to ensure that plans of action and milestones for the information security program and associated organizational systems document remedial information security risk management actions to adequately respond to risks to organizational operations and assets, individuals, other organizations, and the Nation;
      2. a process to ensure that plans of action and milestones for the privacy program and associated organizational systems document remedial privacy risk management actions to adequately respond to risks to organizational operations and assets, individuals, other organizations, and the Nation;
      3. a process to ensure that plans of action and milestones for the supply chain risk management program and associated organizational systems document remedial supply chain risk management actions to adequately respond to risks to organizational operations and assets, individuals, other organizations, and the Nation;
   3. 1. a process to ensure that plans of action and milestones for the information security risk management programs and associated organizational systems are reported in accordance with established reporting requirements;
      2. a process to ensure that plans of action and milestones for the privacy risk management programs and associated organizational systems are reported in accordance with established reporting requirements;
      3. a process to ensure that plans of action and milestones for the supply chain risk management programs and associated organizational systems are reported in accordance with established reporting requirements;
2. 1. plans of action and milestones are reviewed for consistency with the organizational risk management strategy;
   2. plans of action and milestones are reviewed for consistency with organization-wide priorities for risk response actions.

Assessment Method

Examine

Interview

Control

Discussion

Assessment Objective

1. an inventory of organizational systems is developed;
2. the inventory of organizational systems is updated [Assignement: frequency].

Assessment Method

Examine

Interview

Control

Discussion

Assessment Objective

1. information security measures of performance are developed;
2. information security measures of performance are monitored;
3. the results of information security measures of performance are reported;
4. privacy measures of performance are developed;
5. privacy measures of performance are monitored;
6. the results of privacy measures of performance are reported.

Assessment Method

Examine

Interview

Control

Discussion

Assessment Objective

1. an enterprise architecture is developed with consideration for information security;
2. an enterprise architecture is maintained with consideration for information security;
3. an enterprise architecture is developed with consideration for privacy;
4. an enterprise architecture is maintained with consideration for privacy;
5. an enterprise architecture is developed with consideration for the resulting risk to organizational operations and assets, individuals, other organizations, and the Nation;
6. an enterprise architecture is maintained with consideration for the resulting risk to organizational operations and assets, individuals, other organizations, and the Nation.

Assessment Method

Examine

Interview

Control

Discussion

Assessment Objective

1. information security issues are addressed in the development of a critical infrastructure and key resources protection plan;
2. information security issues are addressed in the documentation of a critical infrastructure and key resources protection plan;
3. information security issues are addressed in the update of a critical infrastructure and key resources protection plan;
4. privacy issues are addressed in the development of a critical infrastructure and key resources protection plan;
5. privacy issues are addressed in the documentation of a critical infrastructure and key resources protection plan;
6. privacy issues are addressed in the update of a critical infrastructure and key resources protection plan.

Assessment Method

Examine

Interview

Control

1. Develops a comprehensive strategy to manage:
   1. Security risk to organizational operations and assets, individuals, other organizations, and the Nation associated with the operation and use of organizational systems; and
   2. Privacy risk to individuals resulting from the authorized processing of personally identifiable information;
2. Implement the risk management strategy consistently across the organization; and
3. Review and update the risk management strategy [Assignement: frequency] or as required, to address organizational changes.

Discussion

Assessment Objective

1. 1. a comprehensive strategy is developed to manage security risk to organizational operations and assets, individuals, other organizations, and the Nation associated with the operation and use of organizational systems;
   2. a comprehensive strategy is developed to manage privacy risk to individuals resulting from the authorized processing of personally identifiable information;
2. the risk management strategy is implemented consistently across the organization;
3. the risk management strategy is reviewed and updated [Assignement: frequency] or as required to address organizational changes.

Assessment Method

Examine

Interview

Control

1. Manage the security and privacy state of organizational systems and the environments in which those systems operate through authorization processes;
2. Designate individuals to fulfill specific roles and responsibilities within the organizational risk management process; and
3. Integrate the authorization processes into an organization-wide risk management program.

Discussion

Assessment Objective

1. 1. the security state of organizational systems and the environments in which those systems operate are managed through authorization processes;
   2. the privacy state of organizational systems and the environments in which those systems operate are managed through authorization processes;
2. individuals are designated to fulfill specific roles and responsibilities within the organizational risk management process;
3. the authorization processes are integrated into an organization-wide risk management program.

Assessment Method

Examine

Interview

Control

1. Define organizational mission and business processes with consideration for information security and privacy and the resulting risk to organizational operations, organizational assets, individuals, other organizations, and the Nation; and
2. Determine information protection and personally identifiable information processing needs arising from the defined mission and business processes; and
3. Review and revise the mission and business processes [Assignement: frequency].

Discussion

Assessment Objective

1. 1. organizational mission and business processes are defined with consideration for information security;
   2. organizational mission and business processes are defined with consideration for privacy;
   3. organizational mission and business processes are defined with consideration for the resulting risk to organizational operations, organizational assets, individuals, other organizations, and the Nation;
2. 1. information protection needs arising from the defined mission and business processes are determined;
   2. personally identifiable information processing needs arising from the defined mission and business processes are determined;
3. the mission and business processes are reviewed and revised [Assignement: frequency].

Assessment Method

Examine

Interview

Control

Discussion

Assessment Objective

Assessment Method

Examine

Interview

Control

Discussion

Assessment Objective

1. a security workforce development and improvement program is established;
2. a privacy workforce development and improvement program is established.

Assessment Method

Examine

Interview

Control

1. Implement a process for ensuring that organizational plans for conducting security and privacy testing, training, and monitoring activities associated with organizational systems:
   1. Are developed and maintained; and
   2. Continue to be executed; and
2. Review testing, training, and monitoring plans for consistency with the organizational risk management strategy and organization-wide priorities for risk response actions.

Discussion

Assessment Objective

1. 1. 1. a process is implemented for ensuring that organizational plans for conducting security testing, training, and monitoring activities associated with organizational systems are developed;
      2. a process is implemented for ensuring that organizational plans for conducting security testing, training, and monitoring activities associated with organizational systems are maintained;
      3. a process is implemented for ensuring that organizational plans for conducting privacy testing, training, and monitoring activities associated with organizational systems are developed;
      4. a process is implemented for ensuring that organizational plans for conducting privacy testing, training, and monitoring activities associated with organizational systems are maintained;
   2. 1. a process is implemented for ensuring that organizational plans for conducting security testing, training, and monitoring activities associated with organizational systems continue to be executed;
      2. a process is implemented for ensuring that organizational plans for conducting privacy testing, training, and monitoring activities associated with organizational systems continue to be executed;
2. 1. testing plans are reviewed for consistency with the organizational risk management strategy;
   2. training plans are reviewed for consistency with the organizational risk management strategy;
   3. monitoring plans are reviewed for consistency with the organizational risk management strategy;
   4. testing plans are reviewed for consistency with organization-wide priorities for risk response actions;
   5. training plans are reviewed for consistency with organization-wide priorities for risk response actions;
   6. monitoring plans are reviewed for consistency with organization-wide priorities for risk response actions.

Assessment Method

Examine

Interview

Control

1. To facilitate ongoing security and privacy education and training for organizational personnel;
2. To maintain currency with recommended security and privacy practices, techniques, and technologies; and
3. To share current security and privacy information, including threats, vulnerabilities, and incidents.

Discussion

Assessment Objective

1. 1. contact is established and institutionalized with selected groups and associations within the security community to facilitate ongoing security education and training for organizational personnel;
   2. contact is established and institutionalized with selected groups and associations within the privacy community to facilitate ongoing privacy education and training for organizational personnel;
2. 1. contact is established and institutionalized with selected groups and associations within the security community to maintain currency with recommended security practices, techniques, and technologies;
   2. contact is established and institutionalized with selected groups and associations within the privacy community to maintain currency with recommended privacy practices, techniques, and technologies;
3. 1. contact is established and institutionalized with selected groups and associations within the security community to share current security information, including threats, vulnerabilities, and incidents;
   2. contact is established and institutionalized with selected groups and associations within the privacy community to share current privacy information, including threats, vulnerabilities, and incidents.

Assessment Method

Examine

Interview

Control

Discussion

Assessment Objective

Assessment Method

Examine

Interview

Control

1. Establish policy and procedures to ensure that requirements for the protection of controlled unclassified information that is processed, stored or transmitted on external systems, are implemented in accordance with applicable laws, executive orders, directives, policies, regulations, and standards; and
2. Review and update the policy and procedures [Assignement: organization-defined frequency].

Discussion

Assessment Objective

1. 1. policy is established to ensure that requirements for the protection of controlled unclassified information that is processed, stored, or transmitted on external systems are implemented in accordance with applicable laws, executive orders, directives, policies, regulations, and standards;
   2. procedures are established to ensure that requirements for the protection of controlled unclassified information that is processed, stored, or transmitted on external systems are implemented in accordance with applicable laws, executive orders, directives, policies, regulations, and standards;
2. 1. policy is reviewed and updated [Assignement: frequency];
   2. procedures are reviewed and updated [Assignement: frequency]

Assessment Method

Examine

Interview

Control

1. Develop and disseminate an organization-wide privacy program plan that provides an overview of the agency’s privacy program, and:
   1. Includes a description of the structure of the privacy program and the resources dedicated to the privacy program;
   2. Provides an overview of the requirements for the privacy program and a description of the privacy program management controls and common controls in place or planned for meeting those requirements;
   3. Includes the role of the senior agency official for privacy and the identification and assignment of roles of other privacy officials and staff and their responsibilities;
   4. Describes management commitment, compliance, and the strategic goals and objectives of the privacy program;
   5. Reflects coordination among organizational entities responsible for the different aspects of privacy; and
   6. Is approved by a senior official with responsibility and accountability for the privacy risk being incurred to organizational operations (including mission, functions, image, and reputation), organizational assets, individuals, other organizations, and the Nation; and
2. Update the plan [Assignement: frequency] and to address changes in federal privacy laws and policy and organizational changes and problems identified during plan implementation or privacy control assessments.

Discussion

Assessment Objective

1. 1. an organization-wide privacy program plan that provides an overview of the agency’s privacy program is developed;
   2. 1. the privacy program plan includes a description of the structure of the privacy program;
      2. the privacy program plan includes a description of the resources dedicated to the privacy program;
   3. 1. the privacy program plan provides an overview of the requirements for the privacy program;
      2. the privacy program plan provides a description of the privacy program management controls in place or planned for meeting the requirements of the privacy program;
      3. the privacy program plan provides a description of common controls in place or planned for meeting the requirements of the privacy program;
   4. 1. the privacy program plan includes the role of the senior agency official for privacy;
      2. the privacy program plan includes the identification and assignment of the roles of other privacy officials and staff and their responsibilities;
   5. 1. the privacy program plan describes management commitment;
      2. the privacy program plan describes compliance;
      3. the privacy program plan describes the strategic goals and objectives of the privacy program;
   6. the privacy program plan reflects coordination among organizational entities responsible for the different aspects of privacy;
   7. the privacy program plan is approved by a senior official with responsibility and accountability for the privacy risk being incurred by organizational operations (including, mission, functions, image, and reputation), organizational assets, individuals, other organizations, and the Nation;
   8. the privacy program plan is disseminated;
2. 1. the privacy program plan is updated [Assignement: frequency];
   2. the privacy program plan is updated to address changes in federal privacy laws and policies;
   3. the privacy program plan is updated to address organizational changes;
   4. the privacy program plan is updated to address problems identified during plan implementation or privacy control assessments.

Assessment Method

Examine

Interview

Control

Discussion

Assessment Objective

1. a senior agency official for privacy with authority, mission, accountability, and resources is appointed;
2. the senior agency official for privacy coordinates applicable privacy requirements;
3. the senior agency official for privacy develops applicable privacy requirements;
4. the senior agency official for privacy implements applicable privacy requirements;
5. the senior agency official for privacy manages privacy risks through the organization-wide privacy program.

Assessment Method

Examine

Interview

Control

1. Ensures that the public has access to information about organizational privacy activities and can communicate with its senior agency official for privacy;
2. Ensures that organizational privacy practices and reports are publicly available; and
3. Employs publicly facing email addresses and/or phone lines to enable the public to provide feedback and/or direct questions to privacy offices regarding privacy practices.

Discussion

Assessment Objective

1. a central resource webpage is maintained on the organization’s principal public website;
2. the webpage serves as a central source of information about the organization’s privacy program;
3. 1. the webpage ensures that the public has access to information about organizational privacy activities;
   2. the webpage ensures that the public can communicate with its senior agency official for privacy;
4. 1. the webpage ensures that organizational privacy practices are publicly available;
   2. the webpage ensures that organizational privacy reports are publicly available;
5. the webpage employs publicly facing email addresses and/or phone numbers to enable the public to provide feedback and/or direct questions to privacy offices regarding privacy practices.

Assessment Method

Examine

Interview

Control

1. Develop and maintain an accurate accounting of disclosures of personally identifiable information, including:
   1. Date, nature, and purpose of each disclosure; and
   2. Name and address, or other contact information of the individual or organization to which the disclosure was made;
2. Retain the accounting of disclosures for the length of the time the personally identifiable information is maintained or five years after the disclosure is made, whichever is longer; and
3. Make the accounting of disclosures available to the individual to whom the personally identifiable information relates upon request.

Discussion

Assessment Objective

1. an accurate accounting of disclosures of personally identifiable information is developed and maintained;
   1. 1. the accounting includes the date of each disclosure;
      2. the accounting includes the nature of each disclosure;
      3. the accounting includes the purpose of each disclosure;
   2. 1. the accounting includes the name of the individual or organization to whom the disclosure was made;
      2. the accounting includes the address or other contact information of the individual or organization to whom the disclosure was made;
2. the accounting of disclosures is retained for the length of time that the personally identifiable information is maintained or five years after the disclosure is made, whichever is longer;
3. the accounting of disclosures is made available to the individual to whom the personally identifiable information relates upon request.

Assessment Method

Examine

Interview

Control

1. Reviewing for the accuracy, relevance, timeliness, and completeness of personally identifiable information across the information life cycle;
2. Correcting or deleting inaccurate or outdated personally identifiable information;
3. Disseminating notice of corrected or deleted personally identifiable information to individuals or other appropriate entities; and
4. Appeals of adverse decisions on correction or deletion requests.

Discussion

Assessment Objective

1. organization-wide policies for personally identifiable information quality management are developed and documented;
2. organization-wide procedures for personally identifiable information quality management are developed and documented;
3. 1. the policies address reviewing the accuracy of personally identifiable information across the information life cycle;
   2. the policies address reviewing the relevance of personally identifiable information across the information life cycle;
   3. the policies address reviewing the timeliness of personally identifiable information across the information life cycle;
   4. the policies address reviewing the completeness of personally identifiable information across the information life cycle;
   5. the procedures address reviewing the accuracy of personally identifiable information across the information life cycle;
   6. the procedures address reviewing the relevance of personally identifiable information across the information life cycle;
   7. the procedures address reviewing the timeliness of personally identifiable information across the information life cycle;
   8. the procedures address reviewing the completeness of personally identifiable information across the information life cycle;
4. 1. the policies address correcting or deleting inaccurate or outdated personally identifiable information;
   2. the procedures address correcting or deleting inaccurate or outdated personally identifiable information;
5. 1. the policies address disseminating notice of corrected or deleted personally identifiable information to individuals or other appropriate entities;
   2. the procedures address disseminating notice of corrected or deleted personally identifiable information to individuals or other appropriate entities;
6. 1. the policies address appeals of adverse decisions on correction or deletion requests;
   2. the procedures address appeals of adverse decisions on correction or deletion requests.

Assessment Method

Examine

Interview

Control

Discussion

Assessment Objective

Assessment Method

Examine

Interview

Control

1. Review proposals to conduct or participate in a matching program; and
2. Conduct an annual review of all matching programs in which the agency has participated.

Discussion

Assessment Objective

1. the Data Integrity Board reviews proposals to conduct or participate in a matching program;
2. the Data Integrity Board conducts an annual review of all matching programs in which the agency has participated.

Assessment Method

Examine

Interview

Control

1. Develop, document, and implement policies and procedures that address the use of personally identifiable information for internal testing, training, and research;
2. Limit or minimize the amount of personally identifiable information used for internal testing, training, and research purposes;
3. Authorize the use of personally identifiable information when such information is required for internal testing, training, and research; and
4. Review and update policies and procedures [Assignement: organization-defined frequency].

Discussion

Assessment Objective

1. 1. policies that address the use of personally identifiable information for internal testing are developed and documented;
   2. policies that address the use of personally identifiable information for internal training are developed and documented;
   3. policies that address the use of personally identifiable information for internal research are developed and documented;
   4. procedures that address the use of personally identifiable information for internal testing are developed and documented;
   5. procedures that address the use of personally identifiable information for internal training are developed and documented;
   6. procedures that address the use of personally identifiable information for internal research are developed and documented;
   7. policies that address the use of personally identifiable information for internal testing, are implemented;
   8. policies that address the use of personally identifiable information for training are implemented;
   9. policies that address the use of personally identifiable information for research are implemented;
   10. procedures that address the use of personally identifiable information for internal testing are implemented;
   11. procedures that address the use of personally identifiable information for training are implemented;
   12. procedures that address the use of personally identifiable information for research are implemented;
2. 1. the amount of personally identifiable information used for internal testing purposes is limited or minimized;
   2. the amount of personally identifiable information used for internal training purposes is limited or minimized;
   3. the amount of personally identifiable information used for internal research purposes is limited or minimized;
3. 1. the required use of personally identifiable information for internal testing is authorized;
   2. the required use of personally identifiable information for internal training is authorized;
   3. the required use of personally identifiable information for internal research is authorized;
4. 1. policies are reviewed [Assignement: frequency];
   2. policies are updated [Assignement: frequency];
   3. procedures are reviewed [Assignement: frequency];
   4. procedures are updated [Assignement: frequency].

Assessment Method

Examine

Interview

Control

1. Mechanisms that are easy to use and readily accessible by the public;
2. All information necessary for successfully filing complaints;
3. Tracking mechanisms to ensure all complaints received are reviewed and addressed within [Assignement: organization-defined time period];
4. Acknowledgement of receipt of complaints, concerns, or questions from individuals within [Assignement: time period] ; and
5. Response to complaints, concerns, or questions from individuals within [Assignement: time period].

Discussion

Assessment Objective

1. a process for receiving complaints, concerns, or questions from individuals about organizational security and privacy practices is implemented;
2. a process for responding to complaints, concerns, or questions from individuals about organizational security and privacy practices is implemented;
3. 1. the complaint management process includes mechanisms that are easy to use by the public;
   2. the complaint management process includes mechanisms that are readily accessible by the public;
4. the complaint management process includes all information necessary for successfully filing complaints;
5. 1. the complaint management process includes tracking mechanisms to ensure that all complaints are reviewed within [Assignement: time period];
   2. the complaint management process includes tracking mechanisms to ensure that all complaints are addressed within [Assignement: time period];
6. the complaint management process includes acknowledging the receipt of complaints, concerns, or questions from individuals within [Assignement: time period];
7. the complaint management process includes responding to complaints, concerns, or questions from individuals within [Assignement: time period].

Assessment Method

Examine

Interview

Control

1. Develop [Assignement: privacy reports] and disseminate to:
   1. [Assignement: oversight bodies] to demonstrate accountability with statutory, regulatory, and policy privacy mandates; and
   2. [Assignement: officials] and other personnel with responsibility for monitoring privacy program compliance; and
2. Review and update privacy reports [Assignement: frequency].

Discussion

Assessment Objective

1. [Assignement: privacy reports] are developed;
   1. the privacy reports are disseminated to [Assignement: oversight bodies] to demonstrate accountability with statutory, regulatory, and policy privacy mandates;
   2. 1. the privacy reports are disseminated to [Assignement: officials];
      2. the privacy reports are disseminated to other personnel responsible for monitoring privacy program compliance;
2. the privacy reports are reviewed and updated [Assignement: frequency].

Assessment Method

Examine

Interview

Control

1. Identify and document:
   1. Assumptions affecting risk assessments, risk responses, and risk monitoring;
   2. Constraints affecting risk assessments, risk responses, and risk monitoring;
   3. Priorities and trade-offs considered by the organization for managing risk; and
   4. Organizational risk tolerance;
2. Distribute the results of risk framing activities to [Assignement: personnel] ; and
3. Review and update risk framing considerations [Assignement: frequency].

Discussion

Assessment Objective

1. 1. 1. assumptions affecting risk assessments are identified and documented;
      2. assumptions affecting risk responses are identified and documented;
      3. assumptions affecting risk monitoring are identified and documented;
   2. 1. constraints affecting risk assessments are identified and documented;
      2. constraints affecting risk responses are identified and documented;
      3. constraints affecting risk monitoring are identified and documented;
   3. 1. priorities considered by the organization for managing risk are identified and documented;
      2. trade-offs considered by the organization for managing risk are identified and documented;
   4. organizational risk tolerance is identified and documented;
2. the results of risk framing activities are distributed to [Assignement: personnel];
3. risk framing considerations are reviewed and updated [Assignement: frequency].

Assessment Method

Examine

Interview

Control

1. Appoint a Senior Accountable Official for Risk Management to align organizational information security and privacy management processes with strategic, operational, and budgetary planning processes; and
2. Establish a Risk Executive (function) to view and analyze risk from an organization-wide perspective and ensure management of risk is consistent across the organization.

Discussion

Assessment Objective

1. 1. a Senior Accountable Official for Risk Management is appointed;
   2. a Senior Accountable Official for Risk Management aligns information security and privacy management processes with strategic, operational, and budgetary planning processes;
2. 1. a Risk Executive (function) is established;
   2. a Risk Executive (function) views and analyzes risk from an organization-wide perspective;
   3. a Risk Executive (function) ensures that the management of risk is consistent across the organization.

Assessment Method

Examine

Interview

Control

1. Develop an organization-wide strategy for managing supply chain risks associated with the development, acquisition, maintenance, and disposal of systems, system components, and system services;
2. Implement the supply chain risk management strategy consistently across the organization; and
3. Review and update the supply chain risk management strategy on [Assignement: frequency] or as required, to address organizational changes.

Discussion

Assessment Objective

1. 1. an organization-wide strategy for managing supply chain risks is developed;
   2. the supply chain risk management strategy addresses risks associated with the development of systems;
   3. the supply chain risk management strategy addresses risks associated with the development of system components;
   4. the supply chain risk management strategy addresses risks associated with the development of system services;
   5. the supply chain risk management strategy addresses risks associated with the acquisition of systems;
   6. the supply chain risk management strategy addresses risks associated with the acquisition of system components;
   7. the supply chain risk management strategy addresses risks associated with the acquisition of system services;
   8. the supply chain risk management strategy addresses risks associated with the maintenance of systems;
   9. the supply chain risk management strategy addresses risks associated with the maintenance of system components;
   10. the supply chain risk management strategy addresses risks associated with the maintenance of system services;
   11. the supply chain risk management strategy addresses risks associated with the disposal of systems;
   12. the supply chain risk management strategy addresses risks associated with the disposal of system components;
   13. the supply chain risk management strategy addresses risks associated with the disposal of system services;
2. the supply chain risk management strategy is implemented consistently across the organization;
3. the supply chain risk management strategy is reviewed and updated [Assignement: frequency] or as required to address organizational changes.

Assessment Method

Examine

Interview

Control

1. Establishing the following organization-wide metrics to be monitored: [Assignement: metrics];
2. Establishing [Assignement: monitoring frequencies] and [Assignement: assessment frequencies] for control effectiveness;
3. Ongoing monitoring of organizationally-defined metrics in accordance with the continuous monitoring strategy;
4. Correlation and analysis of information generated by control assessments and monitoring;
5. Response actions to address results of the analysis of control assessment and monitoring information; and
6. Reporting the security and privacy status of organizational systems to [Assignement: organization-defined personnel or roles] [Assignement: organization-defined frequency].

Discussion

Assessment Objective

1. continuous monitoring programs are implemented that include establishing [Assignement: metrics] to be monitored;
2. 1. continuous monitoring programs are implemented that establish [Assignement: monitoring frequencies] for monitoring;
   2. continuous monitoring programs are implemented that establish [Assignement: assessment frequencies] for assessment of control effectiveness;
3. continuous monitoring programs are implemented that include monitoring [Assignement: metrics] on an ongoing basis in accordance with the continuous monitoring strategy;
4. 1. continuous monitoring programs are implemented that include correlating information generated by control assessments and monitoring;
   2. continuous monitoring programs are implemented that include analyzing information generated by control assessments and monitoring;
5. 1. continuous monitoring programs are implemented that include response actions to address the analysis of control assessment information;
   2. continuous monitoring programs are implemented that include response actions to address the analysis of monitoring information;
6. 1. continuous monitoring programs are implemented that include reporting the security status of organizational systems to [Assignement: personnel or roles] [Assignement: frequency];
   2. continuous monitoring programs are implemented that include reporting the privacy status of organizational systems to [Assignement: personnel or roles] [Assignement: frequency].

Assessment Method

Examine

Interview

Control

Discussion

Assessment Objective

Assessment Method

Examine

Interview