Assessment Objective

Determine if:

• PL-08(01)(a)
  • PL-08(01)(a)[01] the security architecture for the system is designed using a defense-in-depth approach that allocates [Assignment: controls] to [Assignment: locations and architectural layers];
  • PL-08(01)(a)[02] the privacy architecture for the system is designed using a defense-in-depth approach that allocates [Assignment: controls] to [Assignment: locations and architectural layers];
• PL-08(01)(b)
  • PL-08(01)(b)[01] the security architecture for the system is designed using a defense-in-depth approach that ensures the allocated controls operate in a coordinated and mutually reinforcing manner;
  • PL-08(01)(b)[02] the privacy architecture for the system is designed using a defense-in-depth approach that ensures the allocated controls operate in a coordinated and mutually reinforcing manner.

Assessment Methods

Examine

• Security and privacy planning policy
• procedures addressing information security and privacy architecture development
• enterprise architecture documentation
• information security and privacy architecture documentation
• system security plan
• privacy plan
• security and privacy CONOPS for the system
• other relevant documents or records

Interview

• Organizational personnel with security and privacy planning and plan implementation responsibilities
• organizational personnel with information security and privacy architecture development responsibilities
• organizational personnel with information security and privacy responsibilities

Test

• Organizational processes for designing the information security and privacy architecture
• mechanisms supporting and/or implementing the design of the information security and privacy architecture

Συνδεδεμένα ζητήματα

• NIST -

  https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final