Assessment Objectives

In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that:

• IAC-04.2_A01 prerequisites and criteria for group and role membership are defined.
  Assessment rigor: 1
  Origin: 53A_R5_AC-02_ODP[01]
• IAC-04.2_A02 criteria for account creation, enabling, modification, disabling and removal are defined.
  Assessment rigor: 1
  Origin: 53A_R5_AC-02_ODP[04] 171A_3.9.2[b]
• IAC-04.2_A03 personnel or roles required to approve requests to create accounts is/are defined.
  Assessment rigor: 1
  Origin: 53A_R5_AC-02_ODP[03]
• IAC-04.2_A04 account managers are assigned.
  Assessment rigor: 1
  Origin: 53A_R5_AC-02b.
• IAC-04.2_A05 attributes (as required) for each account are defined.
  Assessment rigor: 3
  Origin: 53A_R5_AC-02_ODP[02]
• IAC-04.2_A06 personnel or roles to be notified is/are defined.
  Assessment rigor: 3
  Origin: 53A_R5_AC-02_ODP[05]
• IAC-04.2_A07 time period within which to notify account managers when accounts are no longer required is defined.
  Defined parameters: within 24 hours of the account no longer being required
  Assessment rigor: 3
  Origin: 53A_R5_AC-02_ODP[06]
• IAC-04.2_A08 time period within which to notify account managers when users are terminated or transferred is defined.
  Defined parameters: within 24 hours of the termination or transfer
  Assessment rigor: 3
  Origin: 53A_R5_AC-02_ODP[07]
• IAC-04.2_A09 time period within which to notify account managers when system usage or the need to know changes for an individual is defined.
  Defined parameters: within 24 hours of the change in system usage or need to know
  Assessment rigor: 3
  Origin: 53A_R5_AC-02_ODP[08]
• IAC-04.2_A10 attributes needed to authorize system access (as required) are defined.
  Assessment rigor: 3
  Origin: 53A_R5_AC-02_ODP[09]
• IAC-04.2_A11 the frequency of account review is defined.
  Defined parameters: quarterly for privileged access, annually for non-privileged access
  Assessment rigor: 3
  Origin: 53A_R5_AC-02_ODP[10]
• IAC-04.2_A12 account types allowed for use within the system are defined and documented.
  Assessment rigor: 3
  Origin: 53A_R5_AC-02a.[01]
• IAC-04.2_A13 account types specifically prohibited for use within the system are defined and documented.
  Assessment rigor: 3
  Origin: 53A_R5_AC-02a.[02]
• IAC-04.2_A14 prerequisites and criteria for group and role membership are required.
  Assessment rigor: 3
  Origin: 53A_R5_AC-02c.
• IAC-04.2_A15 authorized users of the system are specified.
  Assessment rigor: 3
  Origin: 53A_R5_AC-02d.01
• IAC-04.2_A16 group and role memberships are specified.
  Assessment rigor: 2
  Origin: 53A_R5_AC-02d.02 171A_R3_A.03.01.01.c.02
• IAC-04.2_A17 access authorizations (i.e., privileges) for each account are specified.
  Assessment rigor: 2
  Origin: 53A_R5_AC-02d.03[01] 171A_R3_A.03.01.01.c.03
• IAC-04.2_A18 attributes (as required) are specified for each account.
  Assessment rigor: 3
  Origin: 53A_R5_AC-02d.03[02]
• IAC-04.2_A19 approvals are required by personnel or roles for requests to create accounts.
  Assessment rigor: 3
  Origin: 53A_R5_AC-02e.
• IAC-04.2_A20 accounts are created in accordance with policy, procedures, prerequisites and criteria.
  Assessment rigor: 3
  Origin: 53A_R5_AC-02f.[01]
• IAC-04.2_A21 accounts are enabled in accordance with policy, procedures, prerequisites and criteria.
  Assessment rigor: 3
  Origin: 53A_R5_AC-02f.[02]
• IAC-04.2_A22 accounts are modified in accordance with policy, procedures, prerequisites and criteria.
  Assessment rigor: 2
  Origin: 53A_R5_AC-02f.[03] 171A_3.9.2[b]
• IAC-04.2_A23 accounts are disabled in accordance with policy, procedures, prerequisites and criteria.
  Assessment rigor: 2
  Origin: 53A_R5_AC-02f.[04] 171A_3.9.2[b]
• IAC-04.2_A24 accounts are removed in accordance with policy, procedures, prerequisites and criteria.
  Assessment rigor: 3
  Origin: 53A_R5_AC-02f.[05]
• IAC-04.2_A25 the use of accounts is monitored.
  Assessment rigor: 3
  Origin: 53A_R5_AC-02g.
• IAC-04.2_A26 account managers and personnel or roles are notified within an organization-defined time period when accounts are no longer required.
  Defined parameters: twenty-four (24) hours when accounts are no longer required
  Assessment rigor: 3
  Origin: 53A_R5_AC-02h.01
• IAC-04.2_A27 account managers and personnel or roles are notified within an organization-defined time period when users are terminated or transferred.
  Defined parameters: eight (8) hours when users are terminated or transferred
  Assessment rigor: 3
  Origin: 53A_R5_AC-02h.02
• IAC-04.2_A28 account managers and personnel or roles are notified within an organization-defined time period when system usage or the need to know changes for an individual.
  Defined parameters: eight (8) hours when system usage or need-to-know changes for an individual
  Assessment rigor: 3
  Origin: 53A_R5_AC-02h.03
• IAC-04.2_A29 access to the system is authorized based on a valid access authorization.
  Assessment rigor: 3
  Origin: 53A_R5_AC-02i.01
• IAC-04.2_A30 access to the system is authorized based on intended system usage.
  Assessment rigor: 3
  Origin: 53A_R5_AC-02i.02
• IAC-04.2_A31 access to the system is authorized based on attributes (as required).
  Assessment rigor: 3
  Origin: 53A_R5_AC-02i.03
• IAC-04.2_A32 accounts are reviewed for compliance with account management requirements frequency.
  Defined parameters: quarterly for privileged access, annually for non-privileged access
  Assessment rigor: 3
  Origin: 53A_R5_AC-02j.
• IAC-04.2_A33 a process is established for changing shared or group account authenticators (if deployed) when individuals are removed from the group.
  Assessment rigor: 3
  Origin: 53A_R5_AC-02k.[01]
• IAC-04.2_A34 a process is implemented for changing shared or group account authenticators (if deployed) when individuals are removed from the group.
  Assessment rigor: 3
  Origin: 53A_R5_AC-02k.[02]
• IAC-04.2_A35 account management processes are aligned with personnel termination processes.
  Assessment rigor: 3
  Origin: 53A_R5_AC-02l.[01]
• IAC-04.2_A36 account management processes are aligned with personnel transfer processes.
  Assessment rigor: 3
  Origin: 53A_R5_AC-02l.[02]
• IAC-04.2_A37 privileged user accounts are established and administered in accordance with organization-defined criteria.
  Assessment rigor: 3
  Origin: 53A_R5_AC-02(07)_ODP 53A_R5_AC-02(07)(a)
• IAC-04.2_A38 privileged role or attribute assignments are monitored.
  Assessment rigor: 3
  Origin: 53A_R5_AC-02(07)(b)
• IAC-04.2_A39 changes to roles or attributes are monitored.
  Assessment rigor: 3
  Origin: 53A_R5_AC-02(07)(c)
• IAC-04.2_A40 access is revoked when privileged role or attribute assignments are no longer appropriate.
  Assessment rigor: 3
  Origin: 53A_R5_AC-02(07)(d)

Verknüpfte Vorgänge

• Secure Controls Framework -

  The Secure Controls Framework® (SCF)

  "The SCF is the Common Controls Framework™ (CCF), the world's most comprehensive cybersecurity and data privacy metaframework - it is also free to use. The entire concept is building secure, compliant and resilient capabilities in the most efficient and cost-effective manner possible.
  
  The SCF is more than just a unified control catalog, since its included content creates a playbook for Governance, Risk & Compliance (GRC) capabilities. Used globally by organizations of every size, the SCF is a robust and scalable solution for security, compliance and resilience controls. As a comprehensive security framework, the SCF maps 1,400+ controls across 200+ laws, regulations, and industry frameworks so you can implement once and comply everywhere.
  
  Like it or not, cybersecurity is a protracted war on an asymmetric battlefield, where the threats are everywhere and as defenders we have to make the effort to work together to help improve cybersecurity and data privacy practices, since we all suffer when massive data breaches occur or when cyber attacks have physical impacts. Hackers share information on attack methods with other hackers, so why shouldn’t the good guys share information on how to best protect an organization? We decided to take action and make a difference, since we feel it is too important to wait for someone else to fix the problems that exist.
  
  The SCF is made up of volunteers, mainly specialists within the cybersecurity profession, who focus on GRC and the cybersecurity side of data privacy. These are auditors, engineers, architects, incident responders, consultants and other specialists who live and breathe these topics on a daily basis. The end product is "expert-derived content" that makes up the SCF." https://securecontrolsframework.com/ 

  Terms & Conditions

  The SCF End User License Agreement (EULA) governs the use of the Secure Controls Framework® (SCF) under the Creative Commons Attribution-No Derivatives 4.0 International Public License.