Assessment Objectives

In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that:

• IAC-52_A01 the cycle on which credentials for Control Assurance Automation (CAA) automated identities are rotated is defined.
  Defined parameters: no less frequently than every 90 days, or more frequently where required by the credential type or risk
  Assessment rigor: 1
  Origin: SCF Created
• IAC-52_A02 credentials for Control Assurance Automation (CAA) automated identities are rotated on the defined cycle.
  Assessment rigor: 2
  Origin: SCF Created
• IAC-52_A03 credentials for Control Assurance Automation (CAA) automated identities are rotated, expired or revoked upon personnel change (e.g., departure or role change of the accountable owner or of personnel with knowledge of the credential).
  Assessment rigor: 2
  Origin: SCF Created
• IAC-52_A04 credentials for Control Assurance Automation (CAA) automated identities are rotated, expired or revoked upon tooling change (e.g., replacement, decommissioning or re-platforming of CAA tooling or pipelines).
  Assessment rigor: 2
  Origin: SCF Created
• IAC-52_A05 credentials for Control Assurance Automation (CAA) automated identities are rotated, expired or revoked upon change to the scope of Technology Assets, Applications and/or Services (TAAS) the identity is authorized to assess.
  Assessment rigor: 2
  Origin: SCF Created
• IAC-52_A06 credentials for Control Assurance Automation (CAA) automated identities are configured with an expiration date consistent with the defined rotation cycle.
  Assessment rigor: 1
  Origin: SCF Created
• IAC-52_A07 a record of credential rotation, expiration and revocation events for Control Assurance Automation (CAA) automated identities is retained.
  Assessment rigor: 1
  Origin: SCF Created

Συνδεδεμένα ζητήματα

• Secure Controls Framework -

  EN: GRCA includes the Secure Controls Framework® (SCF) content, © Secure Controls Framework Council, LLC, used under the Creative Commons Attribution-NoDerivatives 4.0 International Public License. SCF control numbers, names, descriptions and mappings appear exactly as published by the SCF Council – https://securecontrolsframework.com. GRCA may group or reorder SCF content for display, which does not change SCF content; the mappings are shown as links to the frameworks they name. Learn more at https://securecontrolsframework.com.

  DE: GRCA enthält Inhalte des Secure Controls Framework® (SCF), © Secure Controls Framework Council, LLC, genutzt unter der Creative Commons Attribution-NoDerivatives 4.0 International Public License. Nummern, Namen, Beschreibungen und Zuordnungen der SCF-Controls erscheinen genau so, wie der SCF Council sie veröffentlicht – https://securecontrolsframework.com. GRCA gruppiert oder sortiert SCF-Inhalte für die Anzeige, ohne sie zu verändern; die Zuordnungen erscheinen als Verknüpfungen zu den genannten Regelwerken. Mehr unter https://securecontrolsframework.com.