Assessment Objective
Determine if:
- PM-15a.
- PM-15a.[01] contact is established and institutionalized with selected groups and associations within the security community to facilitate ongoing security education and training for organizational personnel;
- PM-15a.[02] contact is established and institutionalized with selected groups and associations within the privacy community to facilitate ongoing privacy education and training for organizational personnel;
- PM-15b.
- PM-15b.[01] contact is established and institutionalized with selected groups and associations within the security community to maintain currency with recommended security practices, techniques, and technologies;
- PM-15b.[02] contact is established and institutionalized with selected groups and associations within the privacy community to maintain currency with recommended privacy practices, techniques, and technologies;
- PM-15c.
- PM-15c.[01] contact is established and institutionalized with selected groups and associations within the security community to share current security information, including threats, vulnerabilities, and incidents;
- PM-15c.[02] contact is established and institutionalized with selected groups and associations within the privacy community to share current privacy information, including threats, vulnerabilities, and incidents.
Assessment Methods
Examine
- Information security program plan
- privacy program plan
- risk management strategy
- procedures for establishing and institutionalizing contacts with security and privacy groups and associations
- lists or other records of contacts with and/or membership in security and privacy groups and associations
- other relevant documents or records
Interview
- Organizational personnel with information security and privacy program planning and plan implementation responsibilities
- organizational personnel responsible for establishing and institutionalizing contact with security and privacy groups and associations
- organizational personnel with information security and privacy responsibilities
- personnel from selected groups and associations with which the organization has established and institutionalized contact
Test
- Organizational processes for establishing and institutionalizing contact with security and privacy groups and associations
- mechanisms supporting contact with security and privacy groups and associations
Linkede sager
| Linktype | Sag |
|---|---|
| blocks | PM-15 Security and Privacy Groups and Associations |