Assessment Objective
Determine if:
- PM-31 an organization-wide continuous monitoring strategy is developed;
- PM-31a. continuous monitoring programs are implemented that include establishing [Assignment: metrics] to be monitored;
- PM-31b.
- PM-31b.[01] continuous monitoring programs are implemented that establish [Assignment: monitoring frequencies] for monitoring;
- PM-31b.[02] continuous monitoring programs are implemented that establish [Assignment: assessment frequencies] for assessment of control effectiveness;
- PM-31c. continuous monitoring programs are implemented that include monitoring [Assignment: metrics] on an ongoing basis in accordance with the continuous monitoring strategy;
- PM-31d.
- PM-31d.[01] continuous monitoring programs are implemented that include correlating information generated by control assessments and monitoring;
- PM-31d.[02] continuous monitoring programs are implemented that include analyzing information generated by control assessments and monitoring;
- PM-31e.
- PM-31e.[01] continuous monitoring programs are implemented that include response actions to address the analysis of control assessment information;
- PM-31e.[02] continuous monitoring programs are implemented that include response actions to address the analysis of monitoring information;
- PM-31f.
- PM-31f.[01] continuous monitoring programs are implemented that include reporting the security status of organizational systems to [Assignment: personnel or roles] [Assignment: frequency];
- PM-31f.[02] continuous monitoring programs are implemented that include reporting the privacy status of organizational systems to [Assignment: personnel or roles] [Assignment: frequency].
Assessment Methods
Examine
- Information security program plan
- privacy program plan
- supply chain risk management plan
- continuous monitoring strategy
- risk management strategy
- information security continuous monitoring program documentation, reporting, metrics, and artifacts
- information security continuous monitoring program assessment documentation, reporting, metrics, and artifacts
- assessment and authorization policy
- procedures addressing the continuous monitoring of controls
- privacy program continuous monitoring documentation, reporting, metrics, and artifacts
- continuous monitoring program records, security, and privacy impact analyses
- status reports
- risk response documentation
- other relevant documents or records.
Interview
- Senior Accountable Official for Risk Management
- chief information officer
- senior agency information security officer
- senior agency official for privacy
- organizational personnel with information security, privacy, and supply chain risk management program responsibilities
Test
- Organizational procedures and mechanisms used for information security, privacy, and supply chain continuous monitoring
Linked Issues
| Linktype | Issue |
|---|---|
| blocks | PM-31 Continuous Monitoring Strategy |