Assessment Objectives
In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that:
- IAO-12_A01 deficiencies and vulnerabilities to be addressed by the plan of action are identified.
Assessment rigor: 1
Origin: 171A_3.12.2[a] - IAO-12_A02 a plan of action is developed to document the planned remediation actions of the organization to correct weaknesses or deficiencies noted during the assessment of the controls and to reduce or eliminate known vulnerabilities in the system.
Assessment rigor: 1
Origin: 53A_R5_CA-05a. 171A_3.12.2[b] - IAO-12_A03 the frequency at which to update an existing plan of action based on the findings from control assessments, independent audits or reviews and continuous monitoring activities is defined.
Defined parameters: at least monthly
Assessment rigor: 1
Origin: 53A_R5_CA-05_ODP - IAO-12_A04 existing plan of action is updated organization-defined frequency based on the findings from control assessments, independent audits or reviews and continuous monitoring activities.
Defined parameters: at least monthly
Assessment rigor: 1
Origin: 53A_R5_CA-05b. - IAO-12_A05 a process to ensure the plan of action for the cybersecurity program and associated organizational systems is developed.
Assessment rigor: 3
Origin: 53A_R5_PM-04a.01[01] - IAO-12_A06 a process to ensure the plan of action for the cybersecurity program and associated organizational systems is maintained.
Assessment rigor: 3
Origin: 53A_R5_PM-04a.01[02] - IAO-12_A07 a process to ensure the plan of action for the privacy program and associated organizational systems is developed.
Assessment rigor: 3
Origin: 53A_R5_PM-04a.01[03] - IAO-12_A08 a process to ensure the plan of action for the privacy program and associated organizational systems is maintained.
Assessment rigor: 3
Origin: 53A_R5_PM-04a.01[04] - IAO-12_A09 a process to ensure the plan of action for the supply chain risk management program and associated organizational systems is developed.
Assessment rigor: 3
Origin: 53A_R5_PM-04a.01[05] - IAO-12_A10 a process to ensure the plan of action for the supply chain risk management program and associated organizational systems is maintained.
Assessment rigor: 3
Origin: 53A_R5_PM-04a.01[06] - IAO-12_A11 a process to ensure the plan of action for the cybersecurity program and associated organizational systems documents remedial cybersecurity risk management actions to adequately respond to risks to organizational operations and assets, individuals, other organizations and the Nation.
Assessment rigor: 2
Origin: 53A_R5_PM-04a.02[01] - IAO-12_A12 a process to ensure the plan of action for the privacy program and associated organizational systems documents remedial privacy risk management actions to adequately respond to risks to organizational operations and assets, individuals, other organizations and the Nation.
Assessment rigor: 2
Origin: 53A_R5_PM-04a.02[02] - IAO-12_A13 a process to ensure the plan of action for the supply chain risk management program and associated organizational systems documents remedial supply chain risk management actions to adequately respond to risks to organizational operations and assets, individuals, other organizations and the Nation.
Assessment rigor: 2
Origin: 53A_R5_PM-04a.02[03] - IAO-12_A14 a process to ensure the plan of action for the cybersecurity risk management programs and associated organizational systems is reported in accordance with established reporting requirements.
Assessment rigor: 2
Origin: 53A_R5_PM-04a.03[01] - IAO-12_A15 a process to ensure the plan of action for the privacy risk management programs and associated organizational systems is reported in accordance with established reporting requirements.
Assessment rigor: 2
Origin: 53A_R5_PM-04a.03[02] - IAO-12_A16 a process to ensure the plan of action for the supply chain risk management programs and associated organizational systems is reported in accordance with established reporting requirements.
Assessment rigor: 2
Origin: 53A_R5_PM-04a.03[03] - IAO-12_A17 plan of action is reviewed for consistency with the organizational risk management strategy.
Assessment rigor: 3
Origin: 53A_R5_PM-04b.[01] - IAO-12_A18 plan of action is reviewed for consistency with organization-wide priorities for risk response actions.
Assessment rigor: 3
Origin: 53A_R5_PM-04b.[02] - IAO-12_A19 the developer of the system, system component or system service is required to select and employ security tracking tools for use during the development process.
Assessment rigor: 3
Origin: 53A_R5_SA-15(02)[01] - IAO-12_A20 the developer of the system, system component or system service is required to select and employ privacy tracking tools for use during the development process.
Assessment rigor: 3
Origin: 53A_R5_SA-15(02)[02] - IAO-12_A21 the frequency at which to update an existing plan of action based on the findings from control assessments, independent audits or reviews and continuous monitoring activities is defined.
Defined parameters: at least monthly
Assessment rigor: 3
Origin: 53A_R5_CA-05_ODP - IAO-12_A22 a plan of action is developed to document the planned remediation actions of the organization to correct weaknesses or deficiencies noted during the assessment of the controls and to reduce or eliminate known vulnerabilities in the system.
Assessment rigor: 3
Origin: 53A_R5_CA-05a. - IAO-12_A23 existing plan of action is updated per an organization-defined frequency based on the findings from control assessments, independent audits or reviews and continuous monitoring activities.
Defined parameters: at least monthly
Assessment rigor: 3
Origin: 53A_R5_CA-05b. - IAO-12_A24 a plan of action is developed to document the planned remediation actions for correcting weaknesses or deficiencies noted during security assessments.
Assessment rigor: 2
Origin: 171A_R3_A.03.12.02.a.01 - IAO-12_A25 a plan of action is developed to reduce or eliminate known system vulnerabilities.
Assessment rigor: 2
Origin: 171A_R3_A.03.12.02.a.02 - IAO-12_A26 the existing plan of action is updated based on the findings from security assessments.
Assessment rigor: 2
Origin: 171A_R3_A.03.12.02.b.01 - IAO-12_A27 the existing plan of action is updated based on the findings from audits or reviews.
Assessment rigor: 2
Origin: 171A_R3_A.03.12.02.b.02 - IAO-12_A28 the existing plan of action is updated based on the findings from continuous monitoring activities.
Assessment rigor: 2
Origin: 171A_R3_A.03.12.02.b.03 - IAO-12_A29 the plan of action is implemented to correct identified deficiencies and reduce or eliminate identified vulnerabilities.
Assessment rigor: 2
Origin: 171A_3.12.2[c]
Verknüpfte Vorgänge
| Verknüpfungstyp | Vorgang |
|---|---|
| blocks | Capabilities Deficiency Tracking |
- Secure Controls Framework -
The Secure Controls Framework® (SCF)
"The SCF is the Common Controls Framework™ (CCF), the world's most comprehensive cybersecurity and data privacy metaframework - it is also free to use. The entire concept is building secure, compliant and resilient capabilities in the most efficient and cost-effective manner possible.
The SCF is more than just a unified control catalog, since its included content creates a playbook for Governance, Risk & Compliance (GRC) capabilities. Used globally by organizations of every size, the SCF is a robust and scalable solution for security, compliance and resilience controls. As a comprehensive security framework, the SCF maps 1,400+ controls across 200+ laws, regulations, and industry frameworks so you can implement once and comply everywhere.
Like it or not, cybersecurity is a protracted war on an asymmetric battlefield, where the threats are everywhere and as defenders we have to make the effort to work together to help improve cybersecurity and data privacy practices, since we all suffer when massive data breaches occur or when cyber attacks have physical impacts. Hackers share information on attack methods with other hackers, so why shouldn’t the good guys share information on how to best protect an organization? We decided to take action and make a difference, since we feel it is too important to wait for someone else to fix the problems that exist.
The SCF is made up of volunteers, mainly specialists within the cybersecurity profession, who focus on GRC and the cybersecurity side of data privacy. These are auditors, engineers, architects, incident responders, consultants and other specialists who live and breathe these topics on a daily basis. The end product is "expert-derived content" that makes up the SCF." https://securecontrolsframework.com/Terms & Conditions
The SCF End User License Agreement (EULA) governs the use of the Secure Controls Framework® (SCF) under the Creative Commons Attribution-No Derivatives 4.0 International Public License.