Assessment Objective
Determine if:
- PL-07a. a CONOPS for the system describing how the organization intends to operate the system from the perspective of information security and privacy is developed;
- PL-07b. the CONOPS is reviewed and updated [Assignment: frequency].
Assessment Methods
Examine
- Security and privacy planning policy
- procedures addressing security and privacy CONOPS development
- procedures addressing security and privacy CONOPS reviews and updates
- security and privacy CONOPS for the system
- system security plan
- privacy plan
- records of security and privacy CONOPS reviews and updates
- other relevant documents or records
Interview
- Organizational personnel with security and privacy planning and plan implementation responsibilities
- organizational personnel with information security and privacy responsibilities
Test
- Organizational processes for developing, reviewing, and updating the security CONOPS
- mechanisms supporting and/or implementing the development, review, and update of the security CONOPS
Linked Issues
| Linktype | Issue |
|---|---|
| blocks | PL-07 Concept of Operations |