+SA-10(07) Security and Privacy Representatives

SA-10(07) Security and Privacy Representatives

Control

Require [Assignement: organization-defined security and privacy representatives] to be included in the [Assignement: organization-defined configuration change management and control process].

Discussion

Information security and privacy representatives can include system security officers, senior agency information security officers, senior agency officials for privacy, and system privacy officers. Representation by personnel with information security and privacy expertise is important because changes to system configurations can have unintended side effects, some of which may be security- or privacy-relevant. Detecting such changes early in the process can help avoid unintended, negative consequences that could ultimately affect the security and privacy posture of systems. The configuration change management and control process in this control enhancement refers to the change management and control process defined by organizations in [SA-10b](#sa-10_smt.b).

Assessment Objective

  1. [Assignement: security representatives] are required to be included in the [Assignement: configuration change management and control processes];
  2. [Assignement: privacy representatives] are required to be included in the [Assignement: configuration change management and control processes].

Assessment Method

Examine

System and services acquisition policy system and services acquisition procedures configuration management policy configuration management plan solicitation documentation requiring representatives for security and privacy acquisition documentation service level agreements acquisition contracts for the system, system component, or system service system developer configuration management plan change control records configuration management records system security plan other relevant documents or records

Interview

Organizational personnel with system and service acquisition responsibilities organizational personnel with information security and privacy responsibilities organizational personnel with configuration management responsibilities system developers

1. Übersicht

1.1 Referenzen

1.2 Identifizierte Anforderungen

1.3 Zugehörige Regulierungen

2. Identifizierte Anforderungen

Anforderungen

3. Zugehörige Regulierungen

Regulierungen

Verknüpfte Vorgänge

Verknüpfungen
is blocked by SA-10(07) Security and Privacy Representatives – Assessment Procedure
is blocked by Security, Compliance & Resilience Representatives For Product Changes