Assessment Objective
Determine if:
- PM-06[01] information security measures of performance are developed;
- PM-06[02] information security measures of performance are monitored;
- PM-06[03] the results of information security measures of performance are reported;
- PM-06[04] privacy measures of performance are developed;
- PM-06[05] privacy measures of performance are monitored;
- PM-06[06] the results of privacy measures of performance are reported.
Assessment Methods
Examine
- Information security program plan
- privacy program plan
- information security measures of performance
- privacy measures of performance
- procedures addressing the development, monitoring, and reporting of information security and privacy measures of performance
- risk management strategy
- other relevant documents or records
Interview
- Organizational personnel with information security and privacy program planning and plan implementation responsibilities
- organizational personnel responsible for developing, monitoring, and reporting information security and privacy measures of performance
- organizational personnel with information security and privacy responsibilities
Test
- Organizational processes for developing, monitoring, and reporting information security and privacy measures of performance
- mechanisms supporting the development, monitoring, and reporting of information security and privacy measures of performance
Verknüpfte Vorgänge
| Verknüpfungstyp | Vorgang |
|---|---|
| blocks | PM-06 [P] Measures of Performance |