Assessment Objective
Determine if:
- CA-07(03)[01] trend analysis is employed to determine if control implementations used in the continuous monitoring process need to be modified based on empirical data;
- CA-07(03)[02] trend analysis is employed to determine if the frequency of continuous monitoring activities used in the continuous monitoring process needs to be modified based on empirical data;
- CA-07(03)[03] trend analysis is employed to determine if the types of activities used in the continuous monitoring process need to be modified based on empirical data.
Assessment Methods
Examine
- Organizational continuous monitoring strategy
- system-level continuous monitoring strategy
- assessment, authorization, and monitoring policy
- procedures addressing continuous monitoring of system controls
- privacy controls
- assessment report
- plan of action and milestones
- system monitoring records
- impact analyses
- status reports
- system security plan
- privacy plan
- other relevant documents or records
Interview
- Organizational personnel with continuous monitoring responsibilities
- organizational personnel with information security and privacy responsibilities
Test
- Mechanisms supporting trend analyses
Linked Issues
| Linktype | Issue |
|---|---|
| blocks | CA-07(03) Trend Analyses |