+CM-04(01) [H] Separate Test Environments
|
CM-04(01) [H] Separate Test Environments
Control
Analyze changes to the system in a separate test environment before implementation in an operational environment, looking for security and privacy impacts due to flaws, weaknesses, incompatibility, or intentional malice.
Discussion
A separate test environment requires an environment that is physically or logically separate and distinct from the operational environment. The separation is sufficient to ensure that activities in the test environment do not impact activities in the operational environment and that information in the operational environment is not inadvertently transmitted to the test environment. Separate environments can be achieved by physical or logical means. If physically separate test environments are not implemented, organizations determine the strength of mechanism required when implementing logical separation.
Assessment Objective
- changes to the system are analyzed in a separate test environment before implementation in an operational environment;
- changes to the system are analyzed for security impacts due to flaws;
- changes to the system are analyzed for privacy impacts due to flaws;
- changes to the system are analyzed for security impacts due to weaknesses;
- changes to the system are analyzed for privacy impacts due to weaknesses;
- changes to the system are analyzed for security impacts due to incompatibility;
- changes to the system are analyzed for privacy impacts due to incompatibility;
- changes to the system are analyzed for security impacts due to intentional malice;
- changes to the system are analyzed for privacy impacts due to intentional malice.
Assessment Method
Examine
Configuration management policy
procedures addressing security impact analyses for changes to the system
procedures addressing privacy impact analyses for changes to the system
configuration management plan
security impact analysis documentation
privacy impact analysis documentation
privacy impact assessment
privacy risk assessment documentation
analysis tools and associated outputs system design documentation
system architecture and configuration documentation
change control records
procedures addressing the authority to test with PII
system audit records
documentation of separate test and operational environments
system security plan
privacy plan
other relevant documents or records
Interview
Organizational personnel with responsibility for conducting security and privacy impact analyses
organizational personnel with information security and privacy responsibilities
system/network administrators
members of change control board or similar
1. Oversigt
1.1 Referencer
1.2 Identificerede krav
1.3 Relaterede reguleringer
2. Identificerede krav
3. Relaterede reguleringer
Reguleringer
| Kilde |
Regulering |
Linkede sager
|