+PM-07 [P] Enterprise Architecture

PM-07 [P] Enterprise Architecture

Control

Develop and maintain an enterprise architecture with consideration for information security, privacy, and the resulting risk to organizational operations and assets, individuals, other organizations, and the Nation.

Discussion

The integration of security and privacy requirements and controls into the enterprise architecture helps to ensure that security and privacy considerations are addressed throughout the system development life cycle and are explicitly related to the organization’s mission and business processes. The process of security and privacy requirements integration also embeds into the enterprise architecture and the organization’s security and privacy architectures consistent with the organizational risk management strategy. For PM-7, security and privacy architectures are developed at a system-of-systems level, representing all organizational systems. For [PL-8](#pl-8) , the security and privacy architectures are developed at a level that represents an individual system. The system-level architectures are consistent with the security and privacy architectures defined for the organization. Security and privacy requirements and control integration are most effectively accomplished through the rigorous application of the Risk Management Framework [SP 800-37](#482e4c99-9dc4-41ad-bba8-0f3f0032c1f8) and supporting security standards and guidelines.

Assessment Objective

  1. an enterprise architecture is developed with consideration for information security;
  2. an enterprise architecture is maintained with consideration for information security;
  3. an enterprise architecture is developed with consideration for privacy;
  4. an enterprise architecture is maintained with consideration for privacy;
  5. an enterprise architecture is developed with consideration for the resulting risk to organizational operations and assets, individuals, other organizations, and the Nation;
  6. an enterprise architecture is maintained with consideration for the resulting risk to organizational operations and assets, individuals, other organizations, and the Nation.

Assessment Method

Examine

Information security program plan privacy program plan enterprise architecture documentation procedures addressing enterprise architecture development results of risk assessments of enterprise architecture other relevant documents or records

Interview

Organizational personnel with information security and privacy program planning and plan implementation responsibilities organizational personnel responsible for developing enterprise architecture organizational personnel responsible for risk assessments of enterprise architecture organizational personnel with information security and privacy responsibilities

1. Oversigt

1.1 Referencer

1.2 Identificerede krav

1.3 Relaterede reguleringer

2. Identificerede krav

Krav

3. Relaterede reguleringer

Reguleringer

Linkede sager

Sagslinks
is blocked by PM-07 [P] Enterprise Architecture – Assessment Procedure
is blocked by Alignment With Enterprise Architecture