Assessment Objective
Determine if:
- RA-09 critical system components and functions are identified by performing a criticality analysis for [Assignment: systems, system components, or system services] at [Assignment: decision points in the system development life cycle].
Assessment Methods
Examine
- Risk assessment policy
- assessment reports
- criticality analysis/finalized criticality for each component/subcomponent
- audit records/event logs
- analysis reports
- system security plan
- other relevant documents or records
Interview
- Organizational personnel with assessment and auditing responsibilities
- organizational personnel with criticality analysis responsibilities
- system/network administrators
- organizational personnel with security responsibilities
Test
- Organizational processes for assessments and audits
- mechanisms/tools supporting and/or implementing assessments and auditing
Linked Issues
| Linktype | Issue |
|---|---|
| blocks | RA-09 [H] Criticality Analysis |