Assessment Objective
Determine if:
- [Assignment: safeguards] that are allocated to [Assignment: architectural layers and locations] are obtained from different suppliers.
Assessment Methods
Examine
- Security planning policy
- procedures addressing information security architecture development
- enterprise architecture documentation
- information security architecture documentation
- system security plan
- security CONOPS for the system
- IT acquisitions policy
- other relevant documents or records
Interview
- Personnel with acquisition responsibilities personnel with information security responsibilities
- personnel with security planning and plan implementation responsibilities
- personnel with information security architecture development responsibilities
Test
- Processes for obtaining information security safeguards from different suppliers