+PL-08(02) Supplier Diversity
|
PL-08(02) Supplier Diversity
Control
Require that [Assignement: controls] allocated to [Assignement: locations and architectural layers] are obtained from different suppliers.
Discussion
Information technology products have different strengths and weaknesses. Providing a broad spectrum of products complements the individual offerings. For example, vendors offering malicious code protection typically update their products at different times, often developing solutions for known viruses, Trojans, or worms based on their priorities and development schedules. By deploying different products at different locations, there is an increased likelihood that at least one of the products will detect the malicious code. With respect to privacy, vendors may offer products that track personally identifiable information in systems. Products may use different tracking methods. Using multiple products may result in more assurance that personally identifiable information is inventoried.
Assessment Objective
[Assignement: controls] that are allocated to [Assignement: locations and architectural layers] are required to be obtained from different suppliers.
Assessment Method
Examine
Security and privacy planning policy
procedures addressing information security and privacy architecture development
enterprise architecture documentation
information security and privacy architecture documentation
system security plan
privacy plan
security and privacy CONOPS for the system
IT acquisitions policy
other relevant documents or records
Interview
Organizational personnel with security and privacy planning and plan implementation responsibilities
organizational personnel with information security and privacy architecture development responsibilities
organizational personnel with acquisition responsibilities
organizational personnel with information security and privacy responsibilities
1. Oversigt
1.1 Referencer
1.2 Identificerede krav
1.3 Relaterede reguleringer
2. Identificerede krav
3. Relaterede reguleringer
Reguleringer
| Kilde |
Regulering |
Linkede sager
|