03.11.10E Criticality Analysis

Statement

Identify critical system components and functions by performing a criticality analysis for {{ insert: param, A.03.11.10E.ODP.01 }} at {{ insert: param, A.03.11.10E.ODP.02 }}.

Guidance

Organizations conduct a functional decomposition of a system to identify mission-critical functions and system components. The functional decomposition includes the identification of organizational missions supported by the system, the specific functions to perform those missions, and traceability to the hardware, software, and firmware components that implement those functions, including when the functions are shared by components within and external to the system. The operational environment of a system or a system component may impact its criticality, including the connections to and dependencies on other systems, devices, system-of-systems, and outsourced IT services. System components that allow unmediated access to critical system components or functions are considered critical due to the inherent vulnerabilities that such components create. Criticality analysis is performed when an architecture or design is being developed, modified, or upgraded. If such analysis is performed early and throughout the system development life cycle, organizations may be able to modify the system design to reduce the critical nature of these functions and components, such as by adding redundancy or alternate paths into the system design. This requirement is sourced to a control tailored out of the SP 800-53B .13 moderate baseline in SP 800-171.

Statement

• (includes preempt) Ensure that the threat event does not have an impact.

  • Reduce likelihood of occurrence and/or reduce likelihood of impact.

  • The adversary’s efforts or resources cannot be applied or are wasted.

Assessment objective

critical system components and functions are identified by performing a criticality analysis for {{ insert: param, A.03.11.10E.ODP.01 }} at {{ insert: param, A.03.11.10E.ODP.02 }}.

Assessment method

• Risk assessment policy assessment reports criticality analysis and/or finalized criticality for each component and/or subcomponent audit records and/or event logs analysis reports system security plan other relevant documents or records

Assessment method

• Personnel with assessment and auditing responsibilities personnel with criticality analysis responsibilities system/network administrators personnel with information security responsibilities

Assessment method

• Processes for assessments and audits mechanisms and/or tools supporting and/or implementing assessments and auditing

1. Übersicht

1.1 Referenzen

1.2 Identifizierte Anforderungen

1.3 Zugehörige Regulierungen

2. Identifizierte Anforderungen

3. Zugehörige Regulierungen

Verknüpfte Vorgänge

• NIST -

  https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final