Assessment Objective
Determine if:
- CM-12(01) automated tools are used to identify [Assignment: information by information type] on [Assignment: system components] to ensure that controls are in place to protect organizational information and individual privacy.
Assessment Methods
Examine
- Configuration management policy
- procedures addressing identification and documentation of information location
- configuration management plan
- system design documentation
- PII inventory documentation
- data mapping documentation
- change control records
- system component inventory
- system security plan
- privacy plan
- other relevant documents or records
Interview
- Organizational personnel with responsibilities for managing information location
- organizational personnel with information security responsibilities
- system/network administrators
- system developers
Test
- Organizational processes governing information location
- automated mechanisms enforcing policies and methods for governing information location
- automated tools used to identify information on system components
Verknüpfte Vorgänge
| Verknüpfungstyp | Vorgang |
|---|---|
| blocks | CM-12(01) Automated Tools to Support Information Location |