Assessment Objective
Determine if:
- PL-08(02) [Assignment: controls] that are allocated to [Assignment: locations and architectural layers] are required to be obtained from different suppliers.
Assessment Methods
Examine
- Security and privacy planning policy
- procedures addressing information security and privacy architecture development
- enterprise architecture documentation
- information security and privacy architecture documentation
- system security plan
- privacy plan
- security and privacy CONOPS for the system
- IT acquisitions policy
- other relevant documents or records
Interview
- Organizational personnel with security and privacy planning and plan implementation responsibilities
- organizational personnel with information security and privacy architecture development responsibilities
- organizational personnel with acquisition responsibilities
- organizational personnel with information security and privacy responsibilities
Test
- Organizational processes for obtaining information security and privacy safeguards from different suppliers
Verknüpfte Vorgänge
| Verknüpfungstyp | Vorgang |
|---|---|
| blocks | PL-08(02) Supplier Diversity |