Assessment Objective
Determine if:
- CA-07(04) risk monitoring is an integral part of the continuous monitoring strategy;
- CA-07(04)(a) effectiveness monitoring is included in risk monitoring;
- CA-07(04)(b) compliance monitoring is included in risk monitoring;
- CA-07(04)(c) change monitoring is included in risk monitoring.
Assessment Methods
Examine
- Assessment, authorization, and monitoring policy
- organizational continuous monitoring strategy
- system-level continuous monitoring strategy
- procedures addressing continuous monitoring of system controls
- assessment report
- plan of action and milestones
- system monitoring records
- impact analyses
- status reports
- system security plan
- privacy plan
- other relevant documents or records
Interview
- Organizational personnel with continuous monitoring responsibilities
- organizational personnel with information security and privacy responsibilities
Test
- Mechanisms supporting risk monitoring
Linked Issues
| Linktype | Issue |
|---|---|
| blocks | CA-07(04) [L] Risk Monitoring |