Assessment Objective

Determine if:

• PM-10a.
  • PM-10a.[01] the security state of organizational systems and the environments in which those systems operate are managed through authorization processes;
  • PM-10a.[02] the privacy state of organizational systems and the environments in which those systems operate are managed through authorization processes;
• PM-10b. individuals are designated to fulfill specific roles and responsibilities within the organizational risk management process;
• PM-10c. the authorization processes are integrated into an organization-wide risk management program.

Assessment Methods

Examine

• Information security program plan
• privacy program plan
• procedures addressing management (i.e., documentation, tracking, and reporting) of the authorization process
• assessment, authorization, and monitoring policy
• assessment, authorization, and monitoring procedures
• system authorization documentation
• lists or other documentation about authorization process roles and responsibilities
• risk assessment results relevant to the authorization process and the organization-wide risk management program
• organizational risk management strategy
• other relevant documents or records

Interview

• Organizational personnel with information security and privacy program planning and plan implementation responsibilities
• organizational personnel responsible for management of the authorization process
• organizational personnel with information security and privacy responsibilities

Test

• Organizational processes for authorization
• mechanisms supporting the authorization process

Linked Issues

• NIST -

  https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final