Assessment Objective

Determine if:

• the risk (including supply chain risk) of unauthorized disclosure resulting from the processing, storage, or transmission of CUI is assessed.
• risk assessments are updated [Assignment: frequency].

Assessment Methods

Examine

• risk assessment policy and procedures
• security planning policy and procedures
• procedures for organizational assessments of risk
• risk assessment
• risk assessment results
• risk assessment reviews
• risk assessment updates
• SCRM policy and procedures
• inventory of critical systems, system components, and system services
• procedures for organizational assessments of supply chain risk
• acquisition policy
• SCRM plan
• system security plan
• other relevant documents or records

Interview

• personnel with risk assessment responsibilities
• personnel with SCRM responsibilities
• personnel with security responsibilities

Test

• processes for organizational risk assessments
• mechanisms for supporting or conducting, documenting, reviewing, disseminating, and updating risk assessments
• mechanisms for supporting or conducting, documenting, reviewing, disseminating, and updating supply chain risk assessments

Linked Issues

• NIST -

  https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final