Assessment Objective
Determine if:
- PM-04a.
- PM-04a.01
- PM-04a.01[01] a process to ensure that plans of action and milestones for the information security program and associated organizational systems are developed;
- PM-04a.01[02] a process to ensure that plans of action and milestones for the information security program and associated organizational systems are maintained;
- PM-04a.01[03] a process to ensure that plans of action and milestones for the privacy program and associated organizational systems are developed;
- PM-04a.01[04] a process to ensure that plans of action and milestones for the privacy program and associated organizational systems are maintained;
- PM-04a.01[05] a process to ensure that plans of action and milestones for the supply chain risk management program and associated organizational systems are developed;
- PM-04a.01[06] a process to ensure that plans of action and milestones for the supply chain risk management program and associated organizational systems are maintained;
- PM-04a.02
- PM-04a.02[01] a process to ensure that plans of action and milestones for the information security program and associated organizational systems document remedial information security risk management actions to adequately respond to risks to organizational operations and assets, individuals, other organizations, and the Nation;
- PM-04a.02[02] a process to ensure that plans of action and milestones for the privacy program and associated organizational systems document remedial privacy risk management actions to adequately respond to risks to organizational operations and assets, individuals, other organizations, and the Nation;
- PM-04a.02[03] a process to ensure that plans of action and milestones for the supply chain risk management program and associated organizational systems document remedial supply chain risk management actions to adequately respond to risks to organizational operations and assets, individuals, other organizations, and the Nation;
- PM-04a.03
- PM-04a.03[01] a process to ensure that plans of action and milestones for the information security risk management programs and associated organizational systems are reported in accordance with established reporting requirements;
- PM-04a.03[02] a process to ensure that plans of action and milestones for the privacy risk management programs and associated organizational systems are reported in accordance with established reporting requirements;
- PM-04a.03[03] a process to ensure that plans of action and milestones for the supply chain risk management programs and associated organizational systems are reported in accordance with established reporting requirements;
- PM-04a.01
- PM-04b.
- PM-04b.[01] plans of action and milestones are reviewed for consistency with the organizational risk management strategy;
- PM-04b.[02] plans of action and milestones are reviewed for consistency with organization-wide priorities for risk response actions.
Assessment Methods
Examine
- Information security program plan
- plans of action and milestones
- procedures addressing plans of action and milestones development and maintenance
- procedures addressing plans of action and milestones reporting
- procedures for reviewing plans of action and milestones for consistency with risk management strategy and risk response priorities
- results of risk assessments associated with plans of action and milestones
- OMB FISMA reporting requirements
- other relevant documents or records
Interview
- Organizational personnel with responsibilities for developing, maintaining, reviewing, and reporting plans of action and milestones
- organizational personnel with information security responsibilities
Test
- Organizational processes for plan of action and milestones development, review, maintenance, and reporting
- mechanisms supporting plans of action and milestones
Verknüpfte Vorgänge
| Verknüpfungstyp | Vorgang |
|---|---|
| blocks | PM-04 [P] Plan of Action and Milestones Process |