Assessment Objective
Determine if:
- CM-13 a map of system data actions is developed and documented.
Assessment Methods
Examine
- Configuration management policy
- procedures for identification and documentation of information location
- procedures for mapping data actions
- configuration management plan
- system security plan
- privacy plan
- system design documentation
- PII inventory documentation
- data mapping documentation
- change control records
- system component inventory
- other relevant documents or records
Interview
- Organizational personnel with responsibilities for managing information location
- organizational personnel responsible for data action mapping
- organizational personnel with information security and privacy responsibilities
- system/network administrators
- system developers
Test
- Organizational processes governing information location
- mechanisms supporting or implementing data action mapping
Linkede sager
| Linktype | Sag |
|---|---|
| blocks | CM-13 Data Action Mapping |