Assessment Objective

Determine if:

• AC-01a.
  • AC-01a.[01] an access control policy is developed and documented;
  • AC-01a.[02] the access control policy is disseminated to [Assignment: personnel or roles];
  • AC-01a.[03] access control procedures to facilitate the implementation of the access control policy and associated controls are developed and documented;
  • AC-01a.[04] the access control procedures are disseminated to [Assignment: personnel or roles];
  • AC-01a.01
    • AC-01a.01(a)
      • AC-01a.01(a)[01] the [Selection (one or more): organization-level; mission/business process-level; system-level] access control policy addresses purpose;
      • AC-01a.01(a)[02] the [Selection (one or more): organization-level; mission/business process-level; system-level] access control policy addresses scope;
      • AC-01a.01(a)[03] the [Selection (one or more): organization-level; mission/business process-level; system-level] access control policy addresses roles;
      • AC-01a.01(a)[04] the [Selection (one or more): organization-level; mission/business process-level; system-level] access control policy addresses responsibilities;
      • AC-01a.01(a)[05] the [Selection (one or more): organization-level; mission/business process-level; system-level] access control policy addresses management commitment;
      • AC-01a.01(a)[06] the [Selection (one or more): organization-level; mission/business process-level; system-level] access control policy addresses coordination among organizational entities;
      • AC-01a.01(a)[07] the [Selection (one or more): organization-level; mission/business process-level; system-level] access control policy addresses compliance;
    • AC-01a.01(b) the [Selection (one or more): organization-level; mission/business process-level; system-level] access control policy is consistent with applicable laws, Executive Orders, directives, regulations, policies, standards, and guidelines;
• AC-01b. the [Assignment: official] is designated to manage the development, documentation, and dissemination of the access control policy and procedures;
• AC-01c.
  • AC-01c.01
    • AC-01c.01[01] the current access control policy is reviewed and updated [Assignment: frequency];
    • AC-01c.01[02] the current access control policy is reviewed and updated following [Assignment: events];
  • AC-01c.02
    • AC-01c.02[01] the current access control procedures are reviewed and updated [Assignment: frequency];
    • AC-01c.02[02] the current access control procedures are reviewed and updated following [Assignment: events].

Assessment Methods

Examine

• Access control policy and procedures
• system security plan
• privacy plan
• other relevant documents or records

Interview

• Organizational personnel with access control responsibilities
• organizational personnel with information security with information security and privacy responsibilities

Assessment Objective

Determine if:

• AC-03(14) [Assignment: mechanisms] are provided to enable individuals to have access to [Assignment: elements] of their personally identifiable information.

Assessment Methods

Examine

• Access mechanisms (e.g., request forms and application interfaces)
• access control policy
• procedures addressing access enforcement
• system design documentation
• system configuration settings and associated documentation
• documentation regarding access to an individual’s personally identifiable information
• system audit records
• system security plan
• privacy plan
• privacy impact assessment
• privacy assessment findings and/or reports
• other relevant documents or records

Interview

• Organizational personnel with access enforcement responsibilities
• system/network administrators
• organizational personnel with information security and privacy responsibilities
• legal counsel

Test

• Mechanisms implementing access enforcement functions
• mechanisms enabling individual access to personally identifiable information

Assessment Objective

Determine if:

• AT-01a.
  • AT-01a.[01] an awareness and training policy is developed and documented;
  • AT-01a.[02] the awareness and training policy is disseminated to [Assignment: personnel or roles];
  • AT-01a.[03] awareness and training procedures to facilitate the implementation of the awareness and training policy and associated access controls are developed and documented;
  • AT-01a.[04] the awareness and training procedures are disseminated to [Assignment: personnel or roles].
  • AT-01a.01
    • AT-01a.01(a)
      • AT-01a.01(a)[01] the [Selection (one or more): organization-level; mission/business process-level; system-level] awareness and training policy addresses purpose;
      • AT-01a.01(a)[02] the [Selection (one or more): organization-level; mission/business process-level; system-level] awareness and training policy addresses scope;
      • AT-01a.01(a)[03] the [Selection (one or more): organization-level; mission/business process-level; system-level] awareness and training policy addresses roles;
      • AT-01a.01(a)[04] the [Selection (one or more): organization-level; mission/business process-level; system-level] awareness and training policy addresses responsibilities;
      • AT-01a.01(a)[05] the [Selection (one or more): organization-level; mission/business process-level; system-level] awareness and training policy addresses management commitment;
      • AT-01a.01(a)[06] the [Selection (one or more): organization-level; mission/business process-level; system-level] awareness and training policy addresses coordination among organizational entities;
      • AT-01a.01(a)[07] the [Selection (one or more): organization-level; mission/business process-level; system-level] awareness and training policy addresses compliance; and
    • AT-01a.01(b) the [Selection (one or more): organization-level; mission/business process-level; system-level] awareness and training policy is consistent with applicable laws, Executive Orders, directives, regulations, policies, standards, and guidelines; and
• AT-01b. the [Assignment: official] is designated to manage the development, documentation, and dissemination of the awareness and training policy and procedures;
• AT-01c.
  • AT-01c.01
    • AT-01c.01[01] the current awareness and training policy is reviewed and updated [Assignment: frequency];
    • AT-01c.01[02] the current awareness and training policy is reviewed and updated following [Assignment: events];
  • AT-01c.02
    • AT-01c.02[01] the current awareness and training procedures are reviewed and updated [Assignment: frequency];
    • AT-01c.02[02] the current awareness and training procedures are reviewed and updated following [Assignment: events].

Assessment Methods

Examine

• System security plan
• privacy plan
• awareness and training policy and procedures
• other relevant documents or records

Interview

• Organizational personnel with awareness and training responsibilities
• organizational personnel with information security and privacy responsibilities

Assessment Objective

Determine if:

• AT-02a.
  • AT-02a.01
    • AT-02a.01[01] security literacy training is provided to system users (including managers, senior executives, and contractors) as part of initial training for new users;
    • AT-02a.01[02] privacy literacy training is provided to system users (including managers, senior executives, and contractors) as part of initial training for new users;
    • AT-02a.01[03] security literacy training is provided to system users (including managers, senior executives, and contractors) [Assignment: frequency] thereafter;
    • AT-02a.01[04] privacy literacy training is provided to system users (including managers, senior executives, and contractors) [Assignment: frequency] thereafter;
  • AT-02a.02
    • AT-02a.02[01] security literacy training is provided to system users (including managers, senior executives, and contractors) when required by system changes or following [Assignment: events];
    • AT-02a.02[02] privacy literacy training is provided to system users (including managers, senior executives, and contractors) when required by system changes or following [Assignment: events];
• AT-02b. [Assignment: awareness techniques] are employed to increase the security and privacy awareness of system users;
• AT-02c.
  • AT-02c.[01] literacy training and awareness content is updated [Assignment: frequency];
  • AT-02c.[02] literacy training and awareness content is updated following [Assignment: events];
• AT-02d. lessons learned from internal or external security incidents or breaches are incorporated into literacy training and awareness techniques.

Assessment Methods

Examine

• System security plan
• privacy plan
• literacy training and awareness policy
• procedures addressing literacy training and awareness implementation
• appropriate codes of federal regulations
• security and privacy literacy training curriculum
• security and privacy literacy training materials
• training records
• other relevant documents or records

Interview

• Organizational personnel with responsibilities for literacy training and awareness
• organizational personnel with information security and privacy responsibilities
• organizational personnel comprising the general system user community

Test

• Mechanisms managing information security and privacy literacy training

Assessment Objective

Determine if:

• AT-03a.
  • AT-03a.01
    • AT-03a.01[01] role-based security training is provided to [Assignment: roles and responsibilities] before authorizing access to the system, information, or performing assigned duties;
    • AT-03a.01[02] role-based privacy training is provided to [Assignment: roles and responsibilities] before authorizing access to the system, information, or performing assigned duties;
    • AT-03a.01[03] role-based security training is provided to [Assignment: roles and responsibilities] [Assignment: frequency] thereafter;
    • AT-03a.01[04] role-based privacy training is provided to [Assignment: roles and responsibilities] [Assignment: frequency] thereafter;
  • AT-03a.02
    • AT-03a.02[01] role-based security training is provided to personnel with assigned security roles and responsibilities when required by system changes;
    • AT-03a.02[02] role-based privacy training is provided to personnel with assigned security roles and responsibilities when required by system changes;
• AT-03b.
  • AT-03b.[01] role-based training content is updated [Assignment: frequency];
  • AT-03b.[02] role-based training content is updated following [Assignment: events];
• AT-03c. lessons learned from internal or external security incidents or breaches are incorporated into role-based training.

Assessment Methods

Examine

• System security plan
• privacy plan
• security and privacy awareness and training policy
• procedures addressing security and privacy training implementation
• codes of federal regulations
• security and privacy training curriculum
• security and privacy training materials
• training records
• other relevant documents or records

Interview

• Organizational personnel with responsibilities for role-based security and privacy training
• organizational personnel with assigned system security and privacy roles and responsibilities

Test

• Mechanisms managing role-based security and privacy training

Assessment Objective

Determine if:

• AT-03(05) [Assignment: personnel or roles] are provided with initial and refresher training [Assignment: frequency] in the employment and operation of personally identifiable information processing and transparency controls.

Assessment Methods

Examine

• Security and privacy awareness and training policy
• procedures addressing security and privacy awareness training implementation
• security and privacy awareness training curriculum
• security and privacy awareness training materials
• system security plan
• privacy plan
• organizational privacy notices
• organizational policies
• system of records notices
• Privacy Act statements
• computer matching agreements and notices
• privacy impact assessments
• information sharing agreements
• other relevant documents or records

Interview

• Organizational personnel with responsibilities for role-based security and privacy training
• organizational personnel who participate in security and privacy awareness training

Assessment Objective

Determine if:

• AT-04a.
  • AT-04a.[01] information security and privacy training activities, including security and privacy awareness training and specific role-based security and privacy training, are documented;
  • AT-04a.[02] information security and privacy training activities, including security and privacy awareness training and specific role-based security and privacy training, are monitored;
• AT-04b. individual training records are retained for [Assignment: time period].

Assessment Methods

Examine

• Security and privacy awareness and training policy
• procedures addressing security and privacy training records
• security and privacy awareness and training records
• system security plan
• privacy plan
• other relevant documents or records

Interview

• Organizational personnel with information security and privacy training record retention responsibilities

Test

• Mechanisms supporting the management of security and privacy training records

Assessment Objective

Determine if:

• AU-01a.
  • AU-01a.[01] an audit and accountability policy is developed and documented;
  • AU-01a.[02] the audit and accountability policy is disseminated to [Assignment: personnel or roles];
  • AU-01a.[03] audit and accountability procedures to facilitate the implementation of the audit and accountability policy and associated audit and accountability controls are developed and documented;
  • AU-01a.[04] the audit and accountability procedures are disseminated to [Assignment: personnel or roles];
  • AU-01a.01
    • AU-01a.01(a)
      • AU-01a.01(a)[01] the [Selection (one or more): organization-level; mission/business process-level; system-level] of the audit and accountability policy addresses purpose;
      • AU-01a.01(a)[02] the [Selection (one or more): organization-level; mission/business process-level; system-level] of the audit and accountability policy addresses scope;
      • AU-01a.01(a)[03] the [Selection (one or more): organization-level; mission/business process-level; system-level] of the audit and accountability policy addresses roles;
      • AU-01a.01(a)[04] the [Selection (one or more): organization-level; mission/business process-level; system-level] of the audit and accountability policy addresses responsibilities;
      • AU-01a.01(a)[05] the [Selection (one or more): organization-level; mission/business process-level; system-level] of the audit and accountability policy addresses management commitment;
      • AU-01a.01(a)[06] the [Selection (one or more): organization-level; mission/business process-level; system-level] of the audit and accountability policy addresses coordination among organizational entities;
      • AU-01a.01(a)[07] the [Selection (one or more): organization-level; mission/business process-level; system-level] of the audit and accountability policy addresses compliance;
    • AU-01a.01(b) the [Selection (one or more): organization-level; mission/business process-level; system-level] of the audit and accountability policy is consistent with applicable laws, executive orders, directives, regulations, policies, standards, and guidelines;
• AU-01b. the [Assignment: official] is designated to manage the development, documentation, and dissemination of the audit and accountability policy and procedures;
• AU-01c.
  • AU-01c.01
    • AU-01c.01[01] the current audit and accountability policy is reviewed and updated [Assignment: frequency];
    • AU-01c.01[02] the current audit and accountability policy is reviewed and updated following [Assignment: events];
  • AU-01c.02
    • AU-01c.02[01] the current audit and accountability procedures are reviewed and updated [Assignment: frequency];
    • AU-01c.02[02] the current audit and accountability procedures are reviewed and updated following [Assignment: events].

Assessment Methods

Examine

• Audit and accountability policy and procedures
• system security plan
• privacy plan
• other relevant documents or records

Interview

• Organizational personnel with audit and accountability responsibilities
• organizational personnel with information security and privacy responsibilities

Assessment Objective

Determine if:

• AU-02a. [Assignment: event types] that the system is capable of logging are identified in support of the audit logging function;
• AU-02b. the event logging function is coordinated with other organizational entities requiring audit-related information to guide and inform the selection criteria for events to be logged;
• AU-02c.
  • AU-02c.[01] [Assignment: event types (subset of AU-02_ODP[01])] are specified for logging within the system;
  • AU-02c.[02] the specified event types are logged within the system [Assignment: frequency or situation];
• AU-02d. a rationale is provided for why the event types selected for logging are deemed to be adequate to support after-the-fact investigations of incidents;
• AU-02e. the event types selected for logging are reviewed and updated [Assignment: frequency].

Assessment Methods

Examine

• Audit and accountability policy
• procedures addressing auditable events
• system security plan
• privacy plan
• system design documentation
• system configuration settings and associated documentation
• system audit records
• system auditable events
• other relevant documents or records

Interview

• Organizational personnel with audit and accountability responsibilities
• organizational personnel with information security and privacy responsibilities
• system/network administrators

Test

• Mechanisms implementing system auditing

Assessment Objective

Determine if:

• AU-03(03) personally identifiable information contained in audit records is limited to [Assignment: elements] identified in the privacy risk assessment.

Assessment Methods

Examine

• Audit and accountability policy
• system security plan
• privacy plan
• privacy risk assessment
• privacy risk assessment results
• procedures addressing content of audit records
• system design documentation
• system configuration settings and associated documentation
• list of organization-defined auditable events
• system audit records
• third party contracts
• other relevant documents or records

Interview

• Organizational personnel with audit and accountability responsibilities
• organizational personnel with information security and privacy responsibilities
• system/network administrators
• system developers

Test

• system audit capability

Assessment Objective

Determine if:

• AU-11 audit records are retained for [Assignment: time period] to provide support for after-the-fact investigations of incidents and to meet regulatory and organizational information retention requirements.

Assessment Methods

Examine

• Audit and accountability policy
• system security plan
• privacy plan
• audit record retention policy and procedures
• security plan
• organization-defined retention period for audit records
• audit record archives
• audit logs
• audit records
• other relevant documents or records

Interview

• Organizational personnel with audit record retention responsibilities
• organizational personnel with information security and privacy responsibilities
• system/network administrators

Assessment Objective

Determine if:

• CA-01a.
  • CA-01a.[01] an assessment, authorization, and monitoring policy is developed and documented;
  • CA-01a.[02] the assessment, authorization, and monitoring policy is disseminated to [Assignment: personnel or roles];
  • CA-01a.[03] assessment, authorization, and monitoring procedures to facilitate the implementation of the assessment, authorization, and monitoring policy and associated assessment, authorization, and monitoring controls are developed and documented;
  • CA-01a.[04] the assessment, authorization, and monitoring procedures are disseminated to [Assignment: personnel or roles];
  • CA-01a.01
    • CA-01a.01(a)
      • CA-01a.01(a)[01] the [Selection (one or more): organization-level; mission/business process-level; system-level] assessment, authorization, and monitoring policy addresses purpose;
      • CA-01a.01(a)[02] the [Selection (one or more): organization-level; mission/business process-level; system-level] assessment, authorization, and monitoring policy addresses scope;
      • CA-01a.01(a)[03] the [Selection (one or more): organization-level; mission/business process-level; system-level] assessment, authorization, and monitoring policy addresses roles;
      • CA-01a.01(a)[04] the [Selection (one or more): organization-level; mission/business process-level; system-level] assessment, authorization, and monitoring policy addresses responsibilities;
      • CA-01a.01(a)[05] the [Selection (one or more): organization-level; mission/business process-level; system-level] assessment, authorization, and monitoring policy addresses management commitment;
      • CA-01a.01(a)[06] the [Selection (one or more): organization-level; mission/business process-level; system-level] assessment, authorization, and monitoring policy addresses coordination among organizational entities;
      • CA-01a.01(a)[07] the [Selection (one or more): organization-level; mission/business process-level; system-level] assessment, authorization, and monitoring policy addresses compliance;
    • CA-01a.01(b) the [Selection (one or more): organization-level; mission/business process-level; system-level] assessment, authorization, and monitoring policy is consistent with applicable laws, executive orders, directives, regulations, policies, standards, and guidelines;
• CA-01b. the [Assignment: official] is designated to manage the development, documentation, and dissemination of the assessment, authorization, and monitoring policy and procedures;
• CA-01c.
  • CA-01c.01
    • CA-01c.01[01] the current assessment, authorization, and monitoring policy is reviewed and updated [Assignment: frequency];
    • CA-01c.01[02] the current assessment, authorization, and monitoring policy is reviewed and updated following [Assignment: events];
  • CA-01c.02
    • CA-01c.02[01] the current assessment, authorization, and monitoring procedures are reviewed and updated [Assignment: frequency];
    • CA-01c.02[02] the current assessment, authorization, and monitoring procedures are reviewed and updated following [Assignment: events].

Assessment Methods

Examine

• Assessment, authorization, and monitoring policy and procedures
• system security plan
• privacy plan
• other relevant documents or records

Interview

• Organizational personnel with assessment, authorization, and monitoring policy responsibilities
• organizational personnel with information security and privacy responsibilities

Assessment Objective

Determine if:

• CA-02a. an appropriate assessor or assessment team is selected for the type of assessment to be conducted;
• CA-02b.
  • CA-02b.01 a control assessment plan is developed that describes the scope of the assessment, including controls and control enhancements under assessment;
  • CA-02b.02 a control assessment plan is developed that describes the scope of the assessment, including assessment procedures to be used to determine control effectiveness;
  • CA-02b.03
    • CA-02b.03[01] a control assessment plan is developed that describes the scope of the assessment, including the assessment environment;
    • CA-02b.03[02] a control assessment plan is developed that describes the scope of the assessment, including the assessment team;
    • CA-02b.03[03] a control assessment plan is developed that describes the scope of the assessment, including assessment roles and responsibilities;
• CA-02c. the control assessment plan is reviewed and approved by the authorizing official or designated representative prior to conducting the assessment;
• CA-02d.
  • CA-02d.[01] controls are assessed in the system and its environment of operation [Assignment: assessment frequency] to determine the extent to which the controls are implemented correctly, operating as intended, and producing the desired outcome with respect to meeting established security requirements;
  • CA-02d.[02] controls are assessed in the system and its environment of operation [Assignment: assessment frequency] to determine the extent to which the controls are implemented correctly, operating as intended, and producing the desired outcome with respect to meeting established privacy requirements;
• CA-02e. a control assessment report is produced that documents the results of the assessment;
• CA-02f. the results of the control assessment are provided to [Assignment: individuals or roles].

Assessment Methods

Examine

• Assessment, authorization, and monitoring policy
• procedures addressing assessment planning
• procedures addressing control assessments
• control assessment plan
• control assessment report
• system security plan
• privacy plan
• other relevant documents or records

Interview

• Organizational personnel with control assessment responsibilities
• organizational personnel with information security and privacy responsibilities

Test

• Mechanisms supporting control assessment, control assessment plan development, and/or control assessment reporting

Assessment Objective

Determine if:

• CA-05a. a plan of action and milestones for the system is developed to document the planned remediation actions of the organization to correct weaknesses or deficiencies noted during the assessment of the controls and to reduce or eliminate known vulnerabilities in the system;
• CA-05b. existing plan of action and milestones are updated [Assignment: frequency] based on the findings from control assessments, independent audits or reviews, and continuous monitoring activities.

Assessment Methods

Examine

• Assessment, authorization, and monitoring policy
• procedures addressing plan of action and milestones
• control assessment plan
• control assessment report
• control assessment evidence
• plan of action and milestones
• system security plan
• privacy plan
• other relevant documents or records

Interview

• Organizational personnel with plan of action and milestones development and implementation responsibilities
• organizational personnel with information security and privacy responsibilities

Test

• Mechanisms for developing, implementing, and maintaining plan of action and milestones

Assessment Objective

Determine if:

• CA-06a. a senior official is assigned as the authorizing official for the system;
• CA-06b. a senior official is assigned as the authorizing official for common controls available for inheritance by organizational systems;
• CA-06c.
  • CA-06c.01 before commencing operations, the authorizing official for the system accepts the use of common controls inherited by the system;
  • CA-06c.02 before commencing operations, the authorizing official for the system authorizes the system to operate;
• CA-06d. the authorizing official for common controls authorizes the use of those controls for inheritance by organizational systems;
• CA-06e. the authorizations are updated [Assignment: frequency].

Assessment Methods

Examine

• Assessment, authorization, and monitoring policy
• procedures addressing authorization
• system security plan, privacy plan, assessment report, plan of action and milestones
• authorization statement
• other relevant documents or records

Interview

• Organizational personnel with authorization responsibilities
• organizational personnel with information security and privacy responsibilities

Test

• Mechanisms that facilitate authorizations and updates

Assessment Objective

Determine if:

• CA-07[01] a system-level continuous monitoring strategy is developed;
• CA-07[02] system-level continuous monitoring is implemented in accordance with the organization-level continuous monitoring strategy;
• CA-07a. system-level continuous monitoring includes establishment of the following system-level metrics to be monitored: [Assignment: system-level metrics];
• CA-07b.
  • CA-07b.[01] system-level continuous monitoring includes established [Assignment: frequencies] for monitoring;
  • CA-07b.[02] system-level continuous monitoring includes established [Assignment: frequencies] for assessment of control effectiveness;
• CA-07c. system-level continuous monitoring includes ongoing control assessments in accordance with the continuous monitoring strategy;
• CA-07d. system-level continuous monitoring includes ongoing monitoring of system and organization-defined metrics in accordance with the continuous monitoring strategy;
• CA-07e. system-level continuous monitoring includes correlation and analysis of information generated by control assessments and monitoring;
• CA-07f. system-level continuous monitoring includes response actions to address the results of the analysis of control assessment and monitoring information;
• CA-07g.
  • CA-07g.[01] system-level continuous monitoring includes reporting the security status of the system to [Assignment: personnel or roles] [Assignment: frequency];
  • CA-07g.[02] system-level continuous monitoring includes reporting the privacy status of the system to [Assignment: personnel or roles] [Assignment: frequency].

Assessment Methods

Examine

• Assessment, authorization, and monitoring policy
• organizational continuous monitoring strategy
• system-level continuous monitoring strategy
• procedures addressing continuous monitoring of system controls
• procedures addressing configuration management
• control assessment report
• plan of action and milestones
• system monitoring records
• configuration management records
• impact analyses
• status reports
• system security plan
• privacy plan
• other relevant documents or records

Interview

• Organizational personnel with continuous monitoring responsibilities
• organizational personnel with information security and privacy responsibilities
• system/network administrators

Test

• Mechanisms implementing continuous monitoring
• mechanisms supporting response actions to address assessment and monitoring results
• mechanisms supporting security and privacy status reporting

Assessment Objective

Determine if:

• CA-07(04) risk monitoring is an integral part of the continuous monitoring strategy;
  • CA-07(04)(a) effectiveness monitoring is included in risk monitoring;
  • CA-07(04)(b) compliance monitoring is included in risk monitoring;
  • CA-07(04)(c) change monitoring is included in risk monitoring.

Assessment Methods

Examine

• Assessment, authorization, and monitoring policy
• organizational continuous monitoring strategy
• system-level continuous monitoring strategy
• procedures addressing continuous monitoring of system controls
• assessment report
• plan of action and milestones
• system monitoring records
• impact analyses
• status reports
• system security plan
• privacy plan
• other relevant documents or records

Interview

• Organizational personnel with continuous monitoring responsibilities
• organizational personnel with information security and privacy responsibilities

Test

• Mechanisms supporting risk monitoring

Assessment Objective

Determine if:

• CM-01a.
  • CM-01a.[01] a configuration management policy is developed and documented;
  • CM-01a.[02] the configuration management policy is disseminated to [Assignment: personnel or roles];
  • CM-01a.[03] configuration management procedures to facilitate the implementation of the configuration management policy and associated configuration management controls are developed and documented;
  • CM-01a.[04] the configuration management procedures are disseminated to [Assignment: personnel or roles];
  • CM-01a.01
    • CM-01a.01(a)
      • CM-01a.01(a)[01] the [Selection (one or more): organization-level; mission/business process-level; system-level] of the configuration management policy addresses purpose;
      • CM-01a.01(a)[02] the [Selection (one or more): organization-level; mission/business process-level; system-level] of the configuration management policy addresses scope;
      • CM-01a.01(a)[03] the [Selection (one or more): organization-level; mission/business process-level; system-level] of the configuration management policy addresses roles;
      • CM-01a.01(a)[04] the [Selection (one or more): organization-level; mission/business process-level; system-level] of the configuration management policy addresses responsibilities;
      • CM-01a.01(a)[05] the [Selection (one or more): organization-level; mission/business process-level; system-level] of the configuration management policy addresses management commitment;
      • CM-01a.01(a)[06] the [Selection (one or more): organization-level; mission/business process-level; system-level] of the configuration management policy addresses coordination among organizational entities;
      • CM-01a.01(a)[07] the [Selection (one or more): organization-level; mission/business process-level; system-level] of the configuration management policy addresses compliance;
    • CM-01a.01(b) the configuration management policy is consistent with applicable laws, Executive Orders, directives, regulations, policies, standards, and guidelines;
• CM-01b. the [Assignment: official] is designated to manage the development, documentation, and dissemination of the configuration management policy and procedures;
• CM-01c.
  • CM-01c.01
    • CM-01c.01[01] the current configuration management policy is reviewed and updated [Assignment: frequency];
    • CM-01c.01[02] the current configuration management policy is reviewed and updated following [Assignment: events];
  • CM-01c.02
    • CM-01c.02[01] the current configuration management procedures are reviewed and updated [Assignment: frequency];
    • CM-01c.02[02] the current configuration management procedures are reviewed and updated following [Assignment: events].

Assessment Methods

Examine

• Configuration management policy and procedures
• security and privacy program policies and procedures
• assessment or audit findings
• documentation of security incidents or breaches
• system security plan
• privacy plan
• risk management strategy
• other relevant artifacts, documents, or records

Interview

• Organizational personnel with configuration management responsibilities
• organizational personnel with information security and privacy responsibilities

Assessment Objective

Determine if:

• CM-04[01] changes to the system are analyzed to determine potential security impacts prior to change implementation;
• CM-04[02] changes to the system are analyzed to determine potential privacy impacts prior to change implementation.

Assessment Methods

Examine

• Configuration management policy
• procedures addressing security impact analyses for changes to the system
• procedures addressing privacy impact analyses for changes to the system
• configuration management plan
• security impact analysis documentation
• privacy impact analysis documentation
• privacy impact assessment
• privacy risk assessment documentation, system design documentation
• analysis tools and associated outputs
• change control records
• system audit records
• system security plan
• privacy plan
• other relevant documents or records

Interview

• Organizational personnel with responsibility for conducting security impact analyses
• organizational personnel with responsibility for conducting privacy impact analyses
• organizational personnel with information security and privacy responsibilities
• system developer
• system/network administrators
• members of change control board or similar

Test

• Organizational processes for security impact analyses
• organizational processes for privacy impact analyses

Assessment Objective

Determine if:

• IR-01a.
  • IR-01a.[01] an incident response policy is developed and documented;
  • IR-01a.[02] the incident response policy is disseminated to [Assignment: personnel or roles];
  • IR-01a.[03] incident response procedures to facilitate the implementation of the incident response policy and associated incident response controls are developed and documented;
  • IR-01a.[04] the incident response procedures are disseminated to [Assignment: personnel or roles];
  • IR-01a.01
    • IR-01a.01(a)
      • IR-01a.01(a)[01] the [Selection (one or more): organization-level; mission/business process-level; system-level] incident response policy addresses purpose;
      • IR-01a.01(a)[02] the [Selection (one or more): organization-level; mission/business process-level; system-level] incident response policy addresses scope;
      • IR-01a.01(a)[03] the [Selection (one or more): organization-level; mission/business process-level; system-level] incident response policy addresses roles;
      • IR-01a.01(a)[04] the [Selection (one or more): organization-level; mission/business process-level; system-level] incident response policy addresses responsibilities;
      • IR-01a.01(a)[05] the [Selection (one or more): organization-level; mission/business process-level; system-level] incident response policy addresses management commitment;
      • IR-01a.01(a)[06] the [Selection (one or more): organization-level; mission/business process-level; system-level] incident response policy addresses coordination among organizational entities;
      • IR-01a.01(a)[07] the [Selection (one or more): organization-level; mission/business process-level; system-level] incident response policy addresses compliance;
    • IR-01a.01(b) the [Selection (one or more): organization-level; mission/business process-level; system-level] incident response policy is consistent with applicable laws, Executive Orders, directives, regulations, policies, standards, and guidelines;
• IR-01b. the [Assignment: official] is designated to manage the development, documentation, and dissemination of the incident response policy and procedures;
• IR-01c.
  • IR-01c.01
    • IR-01c.01[01] the current incident response policy is reviewed and updated [Assignment: frequency];
    • IR-01c.01[02] the current incident response policy is reviewed and updated following [Assignment: events];
  • IR-01c.02
    • IR-01c.02[01] the current incident response procedures are reviewed and updated [Assignment: frequency];
    • IR-01c.02[02] the current incident response procedures are reviewed and updated following [Assignment: events].

Assessment Methods

Examine

• Incident response policy and procedures
• system security plan
• privacy plan
• other relevant documents or records

Interview

• Organizational personnel with incident response responsibilities
• organizational personnel with information security and privacy responsibilities

Assessment Objective

Determine if:

• IR-02a.
  • IR-02a.01 incident response training is provided to system users consistent with assigned roles and responsibilities within [Assignment: time period] of assuming an incident response role or responsibility or acquiring system access;
  • IR-02a.02 incident response training is provided to system users consistent with assigned roles and responsibilities when required by system changes;
  • IR-02a.03 incident response training is provided to system users consistent with assigned roles and responsibilities [Assignment: frequency] thereafter;
• IR-02b.
  • IR-02b.[01] incident response training content is reviewed and updated [Assignment: frequency];
  • IR-02b.[02] incident response training content is reviewed and updated following [Assignment: events].

Assessment Methods

Examine

• Incident response policy
• procedures addressing incident response training
• incident response training curriculum
• incident response training materials
• privacy plan
• incident response plan
• incident response training records
• system security plan
• privacy plan
• other relevant documents or records

Interview

• Organizational personnel with incident response training and operational responsibilities
• organizational personnel with information security and privacy responsibilities

Assessment Objective

Determine if:

• IR-02(03)[01] incident response training on how to identify and respond to a breach is provided;
• IR-02(03)[02] incident response training on the organization’s process for reporting a breach is provided.

Assessment Methods

Examine

• Incident response policy
• contingency planning policy
• procedures addressing incident response testing
• procedures addressing contingency plan testing
• incident response testing material
• incident response test results
• incident response test plan
• incident response plan
• contingency plan
• system security plan
• privacy plan
• other relevant documents or records

Interview

• Organizational personnel with incident response training responsibilities
• organizational personnel with information security and privacy responsibilities

Assessment Objective

Determine if:

• IR-03 the effectiveness of the incident response capability for the system is tested [Assignment: frequency] using [Assignment: tests].

Assessment Methods

Examine

• Incident response policy
• contingency planning policy
• procedures addressing incident response testing
• procedures addressing contingency plan testing
• incident response testing material
• incident response test results
• incident response test plan
• incident response plan
• contingency plan
• system security plan
• privacy plan
• other relevant documents or records

Interview

• Organizational personnel with incident response testing responsibilities
• organizational personnel with information security and privacy responsibilities

Assessment Objective

Determine if:

• IR-04a.
  • IR-04a.[01] an incident handling capability for incidents is implemented that is consistent with the incident response plan;
  • IR-04a.[02] the incident handling capability for incidents includes preparation;
  • IR-04a.[03] the incident handling capability for incidents includes detection and analysis;
  • IR-04a.[04] the incident handling capability for incidents includes containment;
  • IR-04a.[05] the incident handling capability for incidents includes eradication;
  • IR-04a.[06] the incident handling capability for incidents includes recovery;
• IR-04b. incident handling activities are coordinated with contingency planning activities;
• IR-04c.
  • IR-04c.[01] lessons learned from ongoing incident handling activities are incorporated into incident response procedures, training, and testing;
  • IR-04c.[02] the changes resulting from the incorporated lessons learned are implemented accordingly;
• IR-04d.
  • IR-04d.[01] the rigor of incident handling activities is comparable and predictable across the organization;
  • IR-04d.[02] the intensity of incident handling activities is comparable and predictable across the organization;
  • IR-04d.[03] the scope of incident handling activities is comparable and predictable across the organization;
  • IR-04d.[04] the results of incident handling activities are comparable and predictable across the organization.

Assessment Methods

Examine

• Incident response policy
• contingency planning policy
• procedures addressing incident handling
• incident response plan
• contingency plan
• system security plan
• privacy plan
• other relevant documents or records

Interview

• Organizational personnel with incident handling responsibilities
• organizational personnel with contingency planning responsibilities
• organizational personnel with information security and privacy responsibilities

Test

• Incident handling capability for the organization

Assessment Objective

Determine if:

• IR-05[01] incidents are tracked;
• IR-05[02] incidents are documented.

Assessment Methods

Examine

• Incident response policy
• procedures addressing incident monitoring
• incident response records and documentation
• incident response plan
• system security plan
• privacy plan
• other relevant documents or records

Interview

• Organizational personnel with incident monitoring responsibilities
• organizational personnel with information security and privacy responsibilities

Test

• Incident monitoring capability for the organization
• mechanisms supporting and/or implementing the tracking and documenting of system security incidents

Assessment Objective

Determine if:

• IR-06a. personnel is/are required to report suspected incidents to the organizational incident response capability within [Assignment: time period];
• IR-06b. incident information is reported to [Assignment: authorities].

Assessment Methods

Examine

• Incident response policy
• procedures addressing incident reporting
• incident reporting records and documentation
• incident response plan
• system security plan
• privacy plan
• other relevant documents or records

Interview

• Organizational personnel with incident reporting responsibilities
• organizational personnel with information security and privacy responsibilities
• personnel who have/should have reported incidents
• personnel (authorities) to whom incident information is to be reported
• system users

Test

• Organizational processes for incident reporting
• mechanisms supporting and/or implementing incident reporting

Assessment Objective

Determine if:

• IR-07[01] an incident response support resource, integral to the organizational incident response capability, is provided;
• IR-07[02] the incident response support resource offers advice and assistance to users of the system for the response and reporting of incidents.

Assessment Methods

Examine

• Incident response policy
• procedures addressing incident response assistance
• incident response plan
• system security plan
• privacy plan
• other relevant documents or records

Interview

• Organizational personnel with incident response assistance and support responsibilities
• organizational personnel with access to incident response support and assistance capability
• organizational personnel with information security and privacy responsibilities

Test

• Organizational processes for incident response assistance
• mechanisms supporting and/or implementing incident response assistance

Assessment Objective

Determine if:

• IR-08a.
  • IR-08a.01 an incident response plan is developed that provides the organization with a roadmap for implementing its incident response capability;
  • IR-08a.02 an incident response plan is developed that describes the structure and organization of the incident response capability;
  • IR-08a.03 an incident response plan is developed that provides a high-level approach for how the incident response capability fits into the overall organization;
  • IR-08a.04 an incident response plan is developed that meets the unique requirements of the organization with regard to mission, size, structure, and functions;
  • IR-08a.05 an incident response plan is developed that defines reportable incidents;
  • IR-08a.06 an incident response plan is developed that provides metrics for measuring the incident response capability within the organization;
  • IR-08a.07 an incident response plan is developed that defines the resources and management support needed to effectively maintain and mature an incident response capability;
  • IR-08a.08 an incident response plan is developed that addresses the sharing of incident information;
  • IR-08a.09 an incident response plan is developed that is reviewed and approved by [Assignment: personnel or roles] [Assignment: frequency];
  • IR-08a.10 an incident response plan is developed that explicitly designates responsibility for incident response to [Assignment: entities, personnel, or roles].
• IR-08b.
  • IR-08b.[01] copies of the incident response plan are distributed to [Assignment: incident response personnel];
  • IR-08b.[02] copies of the incident response plan are distributed to [Assignment: organizational elements];
• IR-08c. the incident response plan is updated to address system and organizational changes or problems encountered during plan implementation, execution, or testing;
• IR-08d.
  • IR-08d.[01] incident response plan changes are communicated to [Assignment: incident response personnel];
  • IR-08d.[02] incident response plan changes are communicated to [Assignment: organizational elements];
• IR-08e.
  • IR-08e.[01] the incident response plan is protected from unauthorized disclosure;
  • IR-08e.[02] the incident response plan is protected from unauthorized modification.

Assessment Methods

Examine

• Incident response policy
• procedures addressing incident response planning
• incident response plan
• system security plan
• privacy plan
• records of incident response plan reviews and approvals
• other relevant documents or records

Interview

• Organizational personnel with incident response planning responsibilities
• organizational personnel with information security and privacy responsibilities

Test

• Organizational incident response plan and related organizational processes

Assessment Objective

Determine if:

• IR-08(01)(a) the incident response plan for breaches involving personally identifiable information includes a process to determine if notice to individuals or other organizations, including oversight organizations, is needed;
• IR-08(01)(b) the incident response plan for breaches involving personally identifiable information includes an assessment process to determine the extent of the harm, embarrassment, inconvenience, or unfairness to affected individuals and any mechanisms to mitigate such harms;
• IR-08(01)(c) the incident response plan for breaches involving personally identifiable information includes the identification of applicable privacy requirements.

Assessment Methods

Examine

• Incident response policy
• procedures addressing incident response planning
• incident response plan
• system security plan
• privacy plan
• records of incident response plan reviews and approvals
• other relevant documents or records

Interview

• Organizational personnel with incident response planning responsibilities
• organizational personnel with information security and privacy responsibilities

Test

• Organizational incident response plan and related organizational processes

Assessment Objective

Determine if:

• MP-01a.
  • MP-01a.[01] a media protection policy is developed and documented;
  • MP-01a.[02] the media protection policy is disseminated to [Assignment: personnel or roles];
  • MP-01a.[03] media protection procedures to facilitate the implementation of the media protection policy and associated media protection controls are developed and documented;
  • MP-01a.[04] the media protection procedures are disseminated to [Assignment: personnel or roles];
  • MP-01a.01
    • MP-01a.01(a)
      • MP-01a.01(a)[01] the [Selection (one or more): organization-level; mission/business process-level; system-level] media protection policy addresses purpose;
      • MP-01a.01(a)[02] the [Selection (one or more): organization-level; mission/business process-level; system-level] media protection policy addresses scope;
      • MP-01a.01(a)[03] the [Selection (one or more): organization-level; mission/business process-level; system-level] media protection policy addresses roles;
      • MP-01a.01(a)[04] the [Selection (one or more): organization-level; mission/business process-level; system-level] media protection policy addresses responsibilities;
      • MP-01a.01(a)[05] the [Selection (one or more): organization-level; mission/business process-level; system-level] media protection policy addresses management commitment;
      • MP-01a.01(a)[06] the [Selection (one or more): organization-level; mission/business process-level; system-level] media protection policy addresses coordination among organizational entities;
      • MP-01a.01(a)[07] the [Selection (one or more): organization-level; mission/business process-level; system-level] media protection policy compliance;
    • MP-01a.01(b) the media protection policy is consistent with applicable laws, Executive Orders, directives, regulations, policies, standards, and guidelines;
• MP-01b. the [Assignment: official] is designated to manage the development, documentation, and dissemination of the media protection policy and procedures.
• MP-01c.
  • MP-01c.01
    • MP-01c.01[01] the current media protection policy is reviewed and updated [Assignment: frequency];
    • MP-01c.01[02] the current media protection policy is reviewed and updated following [Assignment: events];
  • MP-01c.02
    • MP-01c.02[01] the current media protection procedures are reviewed and updated [Assignment: frequency];
    • MP-01c.02[02] the current media protection procedures are reviewed and updated following [Assignment: events].

Assessment Methods

Examine

• Media protection policy and procedures
• organizational risk management strategy
• system security plan
• privacy plan
• other relevant documents or records

Interview

• Organizational personnel with media protection responsibilities
• organizational personnel with information security and privacy responsibilities

Assessment Objective

Determine if:

• MP-06a.
  • MP-06a.[01] [Assignment: system media] is sanitized using [Assignment: sanitization techniques and procedures] prior to disposal;
  • MP-06a.[02] [Assignment: system media] is sanitized using [Assignment: sanitization techniques and procedures] prior to release from organizational control;
  • MP-06a.[03] [Assignment: system media] is sanitized using [Assignment: sanitization techniques and procedures] prior to release for reuse;
• MP-06b. sanitization mechanisms with strength and integrity commensurate with the security category or classification of the information are employed.

Assessment Methods

Examine

• System media protection policy
• procedures addressing media sanitization and disposal
• applicable federal standards and policies addressing media sanitization policy
• media sanitization records
• system audit records
• system design documentation
• records retention and disposition policy
• records retention and disposition procedures
• system configuration settings and associated documentation
• system security plan
• privacy plan
• other relevant documents or records

Interview

• Organizational personnel with media sanitization responsibilities
• organizational personnel with records retention and disposition responsibilities
• organizational personnel with information security and privacy responsibilities
• system/network administrators

Test

• Organizational processes for media sanitization
• mechanisms supporting and/or implementing media sanitization

Assessment Objective

Determine if:

• PE-08(03) personally identifiable information contained in visitor access records is limited to [Assignment: elements] identified in the privacy risk assessment.

Assessment Methods

Examine

• Physical and environmental protection policy
• personally identifiable information processing policy
• privacy risk assessment documentation
• privacy impact assessment
• visitor access records
• personally identifiable information inventory
• system security plan
• privacy plan
• other relevant documents or records

Interview

• Organizational personnel with visitor access records responsibilities
• organizational personnel with information security and privacy responsibilities

Test

• Organizational processes for maintaining and reviewing visitor access records

Assessment Objective

Determine if:

• PL-01a.
  • PL-01a.[01] a planning policy is developed and documented.
  • PL-01a.[02] the planning policy is disseminated to [Assignment: personnel or roles];
  • PL-01a.[03] planning procedures to facilitate the implementation of the planning policy and associated planning controls are developed and documented;
  • PL-01a.[04] the planning procedures are disseminated to [Assignment: personnel or roles];
  • PL-01a.01
    • PL-01a.01(a)
      • PL-01a.01(a)[01] the [Selection (one or more): organization-level; mission/business process-level; system-level] planning policy addresses purpose;
      • PL-01a.01(a)[02] the [Selection (one or more): organization-level; mission/business process-level; system-level] planning policy addresses scope;
      • PL-01a.01(a)[03] the [Selection (one or more): organization-level; mission/business process-level; system-level] planning policy addresses roles;
      • PL-01a.01(a)[04] the [Selection (one or more): organization-level; mission/business process-level; system-level] planning policy addresses responsibilities;
      • PL-01a.01(a)[05] the [Selection (one or more): organization-level; mission/business process-level; system-level] planning policy addresses management commitment;
      • PL-01a.01(a)[06] the [Selection (one or more): organization-level; mission/business process-level; system-level] planning policy addresses coordination among organizational entities;
      • PL-01a.01(a)[07] the [Selection (one or more): organization-level; mission/business process-level; system-level] planning policy addresses compliance;
    • PL-01a.01(b) the [Selection (one or more): organization-level; mission/business process-level; system-level] planning policy is consistent with applicable laws, Executive Orders, directives, regulations, policies, standards, and guidelines;
• PL-01b. the [Assignment: official] is designated to manage the development, documentation, and dissemination of the planning policy and procedures;
• PL-01c.
  • PL-01c.01
    • PL-01c.01[01] the current planning policy is reviewed and updated [Assignment: frequency];
    • PL-01c.01[02] the current planning policy is reviewed and updated following [Assignment: events];
  • PL-01c.02
    • PL-01c.02[01] the current planning procedures are reviewed and updated [Assignment: frequency];
    • PL-01c.02[02] the current planning procedures are reviewed and updated following [Assignment: events].

Assessment Methods

Examine

• Planning policy and procedures
• system security plan
• privacy plan
• other relevant documents or records

Interview

• Organizational personnel with planning responsibilities
• organizational personnel with information security and privacy responsibilities

Assessment Objective

Determine if:

• PL-02a.
  • PL-02a.01
    • PL-02a.01[01] a security plan for the system is developed that is consistent with the organization’s enterprise architecture;
    • PL-02a.01[02] a privacy plan for the system is developed that is consistent with the organization’s enterprise architecture;
  • PL-02a.02
    • PL-02a.02[01] a security plan for the system is developed that explicitly defines the constituent system components;
    • PL-02a.02[02] a privacy plan for the system is developed that explicitly defines the constituent system components;
  • PL-02a.03
    • PL-02a.03[01] a security plan for the system is developed that describes the operational context of the system in terms of mission and business processes;
    • PL-02a.03[02] a privacy plan for the system is developed that describes the operational context of the system in terms of mission and business processes;
  • PL-02a.04
    • PL-02a.04[01] a security plan for the system is developed that identifies the individuals that fulfill system roles and responsibilities;
    • PL-02a.04[02] a privacy plan for the system is developed that identifies the individuals that fulfill system roles and responsibilities;
  • PL-02a.05
    • PL-02a.05[01] a security plan for the system is developed that identifies the information types processed, stored, and transmitted by the system;
    • PL-02a.05[02] a privacy plan for the system is developed that identifies the information types processed, stored, and transmitted by the system;
  • PL-02a.06
    • PL-02a.06[01] a security plan for the system is developed that provides the security categorization of the system, including supporting rationale;
    • PL-02a.06[02] a privacy plan for the system is developed that provides the security categorization of the system, including supporting rationale;
  • PL-02a.07
    • PL-02a.07[01] a security plan for the system is developed that describes any specific threats to the system that are of concern to the organization;
    • PL-02a.07[02] a privacy plan for the system is developed that describes any specific threats to the system that are of concern to the organization;
  • PL-02a.08
    • PL-02a.08[01] a security plan for the system is developed that provides the results of a privacy risk assessment for systems processing personally identifiable information;
    • PL-02a.08[02] a privacy plan for the system is developed that provides the results of a privacy risk assessment for systems processing personally identifiable information;
  • PL-02a.09
    • PL-02a.09[01] a security plan for the system is developed that describes the operational environment for the system and any dependencies on or connections to other systems or system components;
    • PL-02a.09[02] a privacy plan for the system is developed that describes the operational environment for the system and any dependencies on or connections to other systems or system components;
  • PL-02a.10
    • PL-02a.10[01] a security plan for the system is developed that provides an overview of the security requirements for the system;
    • PL-02a.10[02] a privacy plan for the system is developed that provides an overview of the privacy requirements for the system;
  • PL-02a.11
    • PL-02a.11[01] a security plan for the system is developed that identifies any relevant control baselines or overlays, if applicable;
    • PL-02a.11[02] a privacy plan for the system is developed that identifies any relevant control baselines or overlays, if applicable;
  • PL-02a.12
    • PL-02a.12[01] a security plan for the system is developed that describes the controls in place or planned for meeting the security requirements, including rationale for any tailoring decisions;
    • PL-02a.12[02] a privacy plan for the system is developed that describes the controls in place or planned for meeting the privacy requirements, including rationale for any tailoring decisions;
  • PL-02a.13
    • PL-02a.13[01] a security plan for the system is developed that includes risk determinations for security architecture and design decisions;
    • PL-02a.13[02] a privacy plan for the system is developed that includes risk determinations for privacy architecture and design decisions;
  • PL-02a.14
    • PL-02a.14[01] a security plan for the system is developed that includes security-related activities affecting the system that require planning and coordination with [Assignment: individuals or groups];
    • PL-02a.14[02] a privacy plan for the system is developed that includes privacy-related activities affecting the system that require planning and coordination with [Assignment: individuals or groups];
  • PL-02a.15
    • PL-02a.15[01] a security plan for the system is developed that is reviewed and approved by the authorizing official or designated representative prior to plan implementation;
    • PL-02a.15[02] a privacy plan for the system is developed that is reviewed and approved by the authorizing official or designated representative prior to plan implementation.
• PL-02b.
  • PL-02b.[01] copies of the plans are distributed to [Assignment: personnel or roles];
  • PL-02b.[02] subsequent changes to the plans are communicated to [Assignment: personnel or roles];
• PL-02c. plans are reviewed [Assignment: frequency];
• PL-02d.
  • PL-02d.[01] plans are updated to address changes to the system and environment of operations;
  • PL-02d.[02] plans are updated to address problems identified during the plan implementation;
  • PL-02d.[03] plans are updated to address problems identified during control assessments;
• PL-02e.
  • PL-02e.[01] plans are protected from unauthorized disclosure;
  • PL-02e.[02] plans are protected from unauthorized modification.

Assessment Methods

Examine

• Security and privacy planning policy
• procedures addressing system security and privacy plan development and implementation
• procedures addressing security and privacy plan reviews and updates
• enterprise architecture documentation
• system security plan
• privacy plan
• records of system security and privacy plan reviews and updates
• security and privacy architecture and design documentation
• risk assessments
• risk assessment results
• control assessment documentation
• other relevant documents or records

Interview

• Organizational personnel with system security and privacy planning and plan implementation responsibilities
• system developers
• organizational personnel with information security and privacy responsibilities

Test

• Organizational processes for system security and privacy plan development, review, update, and approval
• mechanisms supporting the system security and privacy plan

Assessment Objective

Determine if:

• PL-04a.
  • PL-04a.[01] rules that describe responsibilities and expected behavior for information and system usage, security, and privacy are established for individuals requiring access to the system;
  • PL-04a.[02] rules that describe responsibilities and expected behavior for information and system usage, security, and privacy are provided to individuals requiring access to the system;
• PL-04b. before authorizing access to information and the system, a documented acknowledgement from such individuals indicating that they have read, understand, and agree to abide by the rules of behavior is received;
• PL-04c. rules of behavior are reviewed and updated [Assignment: frequency];
• PL-04d. individuals who have acknowledged a previous version of the rules of behavior are required to read and reacknowledge [Selection (one or more): [Assignment: frequency] ; when the rules are revised or updated].

Assessment Methods

Examine

• Security and privacy planning policy
• procedures addressing rules of behavior for system users
• rules of behavior
• signed acknowledgements
• records for rules of behavior reviews and updates
• other relevant documents or records

Interview

• Organizational personnel with responsibility for establishing, reviewing, and updating rules of behavior
• organizational personnel with responsibility for literacy training and awareness and role-based training
• organizational personnel who are authorized users of the system and have signed and resigned rules of behavior
• organizational personnel with information security and privacy responsibilities

Test

• Organizational processes for establishing, reviewing, disseminating, and updating rules of behavior
• mechanisms supporting and/or implementing the establishment, review, dissemination, and update of rules of behavior

Assessment Objective

Determine if:

• PL-04(01)(a) the rules of behavior include restrictions on the use of social media, social networking sites, and external sites/applications;
• PL-04(01)(b) the rules of behavior include restrictions on posting organizational information on public websites;
• PL-04(01)(c) the rules of behavior include restrictions on the use of organization-provided identifiers (e.g., email addresses) and authentication secrets (e.g., passwords) for creating accounts on external sites/applications.

Assessment Methods

Examine

• Security and privacy planning policy
• procedures addressing rules of behavior for system users
• rules of behavior
• training policy
• other relevant documents or records

Interview

• Organizational personnel with responsibility for establishing, reviewing, and updating rules of behavior
• organizational personnel with responsibility for literacy training and awareness and role-based training
• organizational personnel who are authorized users of the system and have signed rules of behavior
• organizational personnel with information security and privacy responsibilities

Test

• Organizational processes for establishing rules of behavior
• mechanisms supporting and/or implementing the establishment of rules of behavior

Assessment Objective

Determine if:

• PL-08a.
  • PL-08a.01 a security architecture for the system describes the requirements and approach to be taken for protecting the confidentiality, integrity, and availability of organizational information;
  • PL-08a.02 a privacy architecture describes the requirements and approach to be taken for processing personally identifiable information to minimize privacy risk to individuals;
  • PL-08a.03
    • PL-08a.03[01] a security architecture for the system describes how the architecture is integrated into and supports the enterprise architecture;
    • PL-08a.03[02] a privacy architecture for the system describes how the architecture is integrated into and supports the enterprise architecture;
  • PL-08a.04
    • PL-08a.04[01] a security architecture for the system describes any assumptions about and dependencies on external systems and services;
    • PL-08a.04[02] a privacy architecture for the system describes any assumptions about and dependencies on external systems and services;
• PL-08b. changes in the enterprise architecture are reviewed and updated [Assignment: frequency] to reflect changes in the enterprise architecture;
• PL-08c.
  • PL-08c.[01] planned architecture changes are reflected in the security plan;
  • PL-08c.[02] planned architecture changes are reflected in the privacy plan;
  • PL-08c.[03] planned architecture changes are reflected in the Concept of Operations (CONOPS);
  • PL-08c.[04] planned architecture changes are reflected in criticality analysis;
  • PL-08c.[05] planned architecture changes are reflected in organizational procedures;
  • PL-08c.[06] planned architecture changes are reflected in procurements and acquisitions.

Assessment Methods

Examine

• Security and privacy planning policy
• procedures addressing information security and privacy architecture development
• procedures addressing information security and privacy architecture reviews and updates
• enterprise architecture documentation
• information security and privacy architecture documentation
• system security plan
• privacy plan
• security and privacy CONOPS for the system
• records of information security and privacy architecture reviews and updates
• other relevant documents or records

Interview

• Organizational personnel with security and privacy planning and plan implementation responsibilities
• organizational personnel with information security and privacy architecture development responsibilities
• organizational personnel with information security and privacy responsibilities

Test

• Organizational processes for developing, reviewing, and updating the information security and privacy architecture
• mechanisms supporting and/or implementing the development, review, and update of the information security and privacy architecture

Assessment Objective

Determine if:

• PL-09 [Assignment: controls and related processes] are centrally managed.

Assessment Methods

Examine

• Security and privacy planning policy
• procedures addressing security and privacy plan development and implementation
• system security plan
• privacy plan
• other relevant documents or records

Interview

• Organizational personnel with security and privacy planning and plan implementation responsibilities
• organizational personnel with responsibilities for planning/implementing central management of controls and related processes
• organizational personnel with information security and privacy responsibilities

Test

• Organizational processes for the central management of controls and related processes
• mechanisms supporting and/or implementing central management of controls and related processes

Assessment Objective

Determine if:

• PM-03a.
  • PM-03a.[01] the resources needed to implement the information security program are included in capital planning and investment requests, and all exceptions are documented;
  • PM-03a.[02] the resources needed to implement the privacy program are included in capital planning and investment requests, and all exceptions are documented;
• PM-03b.
  • PM-03b.[01] the documentation required for addressing the information security program in capital planning and investment requests is prepared in accordance with applicable laws, executive orders, directives, policies, regulations, standards;
  • PM-03b.[02] the documentation required for addressing the privacy program in capital planning and investment requests is prepared in accordance with applicable laws, executive orders, directives, policies, regulations, standards;
• PM-03c.
  • PM-03c.[01] information security resources are made available for expenditure as planned;
  • PM-03c.[02] privacy resources are made available for expenditure as planned.

Assessment Methods

Examine

• Information security program plan
• Exhibit 300
• Exhibit 53
• business cases for capital planning and investment
• procedures for capital planning and investment
• documentation of exceptions to capital planning requirements
• other relevant documents or records

Interview

• Organizational personnel with information security program planning responsibilities
• organizational personnel with privacy program planning responsibilities
• organizational personnel responsible for capital planning and investment
• organizational personnel with information security responsibilities
• organizational personnel with privacy responsibilities

Test

• Organizational processes for capital planning and investment
• organizational processes for business case, Exhibit 300, and Exhibit 53 development
• mechanisms supporting the capital planning and investment process

Assessment Objective

Determine if:

• PM-04a.
  • PM-04a.01
    • PM-04a.01[01] a process to ensure that plans of action and milestones for the information security program and associated organizational systems are developed;
    • PM-04a.01[02] a process to ensure that plans of action and milestones for the information security program and associated organizational systems are maintained;
    • PM-04a.01[03] a process to ensure that plans of action and milestones for the privacy program and associated organizational systems are developed;
    • PM-04a.01[04] a process to ensure that plans of action and milestones for the privacy program and associated organizational systems are maintained;
    • PM-04a.01[05] a process to ensure that plans of action and milestones for the supply chain risk management program and associated organizational systems are developed;
    • PM-04a.01[06] a process to ensure that plans of action and milestones for the supply chain risk management program and associated organizational systems are maintained;
  • PM-04a.02
    • PM-04a.02[01] a process to ensure that plans of action and milestones for the information security program and associated organizational systems document remedial information security risk management actions to adequately respond to risks to organizational operations and assets, individuals, other organizations, and the Nation;
    • PM-04a.02[02] a process to ensure that plans of action and milestones for the privacy program and associated organizational systems document remedial privacy risk management actions to adequately respond to risks to organizational operations and assets, individuals, other organizations, and the Nation;
    • PM-04a.02[03] a process to ensure that plans of action and milestones for the supply chain risk management program and associated organizational systems document remedial supply chain risk management actions to adequately respond to risks to organizational operations and assets, individuals, other organizations, and the Nation;
  • PM-04a.03
    • PM-04a.03[01] a process to ensure that plans of action and milestones for the information security risk management programs and associated organizational systems are reported in accordance with established reporting requirements;
    • PM-04a.03[02] a process to ensure that plans of action and milestones for the privacy risk management programs and associated organizational systems are reported in accordance with established reporting requirements;
    • PM-04a.03[03] a process to ensure that plans of action and milestones for the supply chain risk management programs and associated organizational systems are reported in accordance with established reporting requirements;
• PM-04b.
  • PM-04b.[01] plans of action and milestones are reviewed for consistency with the organizational risk management strategy;
  • PM-04b.[02] plans of action and milestones are reviewed for consistency with organization-wide priorities for risk response actions.

Assessment Methods

Examine

• Information security program plan
• plans of action and milestones
• procedures addressing plans of action and milestones development and maintenance
• procedures addressing plans of action and milestones reporting
• procedures for reviewing plans of action and milestones for consistency with risk management strategy and risk response priorities
• results of risk assessments associated with plans of action and milestones
• OMB FISMA reporting requirements
• other relevant documents or records

Interview

• Organizational personnel with responsibilities for developing, maintaining, reviewing, and reporting plans of action and milestones
• organizational personnel with information security responsibilities

Test

• Organizational processes for plan of action and milestones development, review, maintenance, and reporting
• mechanisms supporting plans of action and milestones

Assessment Objective

Determine if:

• PM-05(01)[01] an inventory of all systems, applications, and projects that process personally identifiable information is established;
• PM-05(01)[02] an inventory of all systems, applications, and projects that process personally identifiable information is maintained;
• PM-05(01)[03] an inventory of all systems, applications, and projects that process personally identifiable information is updated [Assignment: frequency].

Assessment Methods

Examine

• Procedures addressing system inventory development, maintenance, and updates
• OMB FISMA reporting guidance
• privacy program plan
• information security program plan
• personally identifiable information processing policy
• system inventory
• personally identifiable information inventory
• data mapping documentation
• other relevant documents or records

Interview

• Organizational personnel with privacy program planning and plan implementation responsibilities
• organizational personnel responsible for developing and maintaining the system inventory
• organizational personnel with information security and privacy responsibilities

Test

• Organizational processes for system inventory development, maintenance, and updates
• mechanisms supporting the system inventory

Assessment Objective

Determine if:

• PM-06[01] information security measures of performance are developed;
• PM-06[02] information security measures of performance are monitored;
• PM-06[03] the results of information security measures of performance are reported;
• PM-06[04] privacy measures of performance are developed;
• PM-06[05] privacy measures of performance are monitored;
• PM-06[06] the results of privacy measures of performance are reported.

Assessment Methods

Examine

• Information security program plan
• privacy program plan
• information security measures of performance
• privacy measures of performance
• procedures addressing the development, monitoring, and reporting of information security and privacy measures of performance
• risk management strategy
• other relevant documents or records

Interview

• Organizational personnel with information security and privacy program planning and plan implementation responsibilities
• organizational personnel responsible for developing, monitoring, and reporting information security and privacy measures of performance
• organizational personnel with information security and privacy responsibilities

Test

• Organizational processes for developing, monitoring, and reporting information security and privacy measures of performance
• mechanisms supporting the development, monitoring, and reporting of information security and privacy measures of performance

Assessment Objective

Determine if:

• PM-07[01] an enterprise architecture is developed with consideration for information security;
• PM-07[02] an enterprise architecture is maintained with consideration for information security;
• PM-07[03] an enterprise architecture is developed with consideration for privacy;
• PM-07[04] an enterprise architecture is maintained with consideration for privacy;
• PM-07[05] an enterprise architecture is developed with consideration for the resulting risk to organizational operations and assets, individuals, other organizations, and the Nation;
• PM-07[06] an enterprise architecture is maintained with consideration for the resulting risk to organizational operations and assets, individuals, other organizations, and the Nation.

Assessment Methods

Examine

• Information security program plan
• privacy program plan
• enterprise architecture documentation
• procedures addressing enterprise architecture development
• results of risk assessments of enterprise architecture
• other relevant documents or records

Interview

• Organizational personnel with information security and privacy program planning and plan implementation responsibilities
• organizational personnel responsible for developing enterprise architecture
• organizational personnel responsible for risk assessments of enterprise architecture
• organizational personnel with information security and privacy responsibilities

Test

• Organizational processes for enterprise architecture development
• mechanisms supporting the enterprise architecture and its development

Assessment Objective

Determine if:

• PM-08[01] information security issues are addressed in the development of a critical infrastructure and key resources protection plan;
• PM-08[02] information security issues are addressed in the documentation of a critical infrastructure and key resources protection plan;
• PM-08[03] information security issues are addressed in the update of a critical infrastructure and key resources protection plan;
• PM-08[04] privacy issues are addressed in the development of a critical infrastructure and key resources protection plan;
• PM-08[05] privacy issues are addressed in the documentation of a critical infrastructure and key resources protection plan;
• PM-08[06] privacy issues are addressed in the update of a critical infrastructure and key resources protection plan.

Assessment Methods

Examine

• Information security program plan
• privacy program plan
• critical infrastructure and key resources protection plan
• procedures addressing the development, documentation, and updating of the critical infrastructure and key resources protection plan
• HSPD 7
• National Infrastructure Protection Plan
• other relevant documents or records

Interview

• Organizational personnel with information security and privacy program planning and plan implementation responsibilities
• organizational personnel responsible for developing, documenting, and updating the critical infrastructure and key resources protection plan
• organizational personnel with information security and privacy responsibilities

Test

• Organizational processes for developing, documenting, and updating the critical infrastructure and key resources protection plan
• mechanisms supporting the development, documentation, and updating of the critical infrastructure and key resources protection plan

Assessment Objective

Determine if:

• PM-09a.
  • PM-09a.01 a comprehensive strategy is developed to manage security risk to organizational operations and assets, individuals, other organizations, and the Nation associated with the operation and use of organizational systems;
  • PM-09a.02 a comprehensive strategy is developed to manage privacy risk to individuals resulting from the authorized processing of personally identifiable information;
• PM-09b. the risk management strategy is implemented consistently across the organization;
• PM-09c. the risk management strategy is reviewed and updated [Assignment: frequency] or as required to address organizational changes.

Assessment Methods

Examine

• Information security program plan
• privacy program plan
• risk management strategy
• supply chain risk management strategy
• procedures addressing the development, implementation, review, and update of the risk management strategy
• risk assessment results relevant to the risk management strategy
• other relevant documents or records

Interview

• Organizational personnel with information security and privacy program planning and plan implementation responsibilities
• organizational personnel responsible for the development, implementation, review, and update of the risk management strategy
• organizational personnel with information security and privacy responsibilities

Test

• Organizational processes for the development, implementation, review, and update of the risk management strategy
• mechanisms supporting the development, implementation, review, and update of the risk management strategy

Assessment Objective

Determine if:

• PM-10a.
  • PM-10a.[01] the security state of organizational systems and the environments in which those systems operate are managed through authorization processes;
  • PM-10a.[02] the privacy state of organizational systems and the environments in which those systems operate are managed through authorization processes;
• PM-10b. individuals are designated to fulfill specific roles and responsibilities within the organizational risk management process;
• PM-10c. the authorization processes are integrated into an organization-wide risk management program.

Assessment Methods

Examine

• Information security program plan
• privacy program plan
• procedures addressing management (i.e., documentation, tracking, and reporting) of the authorization process
• assessment, authorization, and monitoring policy
• assessment, authorization, and monitoring procedures
• system authorization documentation
• lists or other documentation about authorization process roles and responsibilities
• risk assessment results relevant to the authorization process and the organization-wide risk management program
• organizational risk management strategy
• other relevant documents or records

Interview

• Organizational personnel with information security and privacy program planning and plan implementation responsibilities
• organizational personnel responsible for management of the authorization process
• organizational personnel with information security and privacy responsibilities

Test

• Organizational processes for authorization
• mechanisms supporting the authorization process

Assessment Objective

Determine if:

• PM-11a.
  • PM-11a.[01] organizational mission and business processes are defined with consideration for information security;
  • PM-11a.[02] organizational mission and business processes are defined with consideration for privacy;
  • PM-11a.[03] organizational mission and business processes are defined with consideration for the resulting risk to organizational operations, organizational assets, individuals, other organizations, and the Nation;
• PM-11b.
  • PM-11b.[01] information protection needs arising from the defined mission and business processes are determined;
  • PM-11b.[02] personally identifiable information processing needs arising from the defined mission and business processes are determined;
• PM-11c. the mission and business processes are reviewed and revised [Assignment: frequency].

Assessment Methods

Examine

• Information security program plan
• privacy program plan
• risk management strategy
• procedures for determining mission and business protection needs
• information security and privacy risk assessment results relevant to the determination of mission and business protection needs
• personally identifiable information processing policy
• personally identifiable information inventory
• other relevant documents or records

Interview

• Organizational personnel with information security and privacy program planning and plan implementation responsibilities
• organizational personnel responsible for enterprise risk management
• organizational personnel responsible for determining information protection needs for mission and business processes
• organizational personnel with information security and privacy responsibilities

Test

• Organizational processes for defining mission and business processes and their information protection needs

Assessment Objective

Determine if:

• PM-13[01] a security workforce development and improvement program is established;
• PM-13[02] a privacy workforce development and improvement program is established.

Assessment Methods

Examine

• Information security program plan
• privacy program plan
• information security and privacy workforce development and improvement program documentation
• procedures for the information security and privacy workforce development and improvement program
• information security and privacy role-based training program documentation
• other relevant documents or records

Interview

• Organizational personnel with information security and privacy program planning and plan implementation responsibilities
• organizational personnel responsible for the information security and privacy workforce development and improvement program
• organizational personnel with information security and privacy responsibilities

Test

• Organizational processes for implementing the information security and privacy workforce development and improvement program
• mechanisms supporting and/or implementing the information security and privacy workforce development and improvement program

Assessment Objective

Determine if:

• PM-14a.
  • PM-14a.01
    • PM-14a.01[01] a process is implemented for ensuring that organizational plans for conducting security testing, training, and monitoring activities associated with organizational systems are developed;
    • PM-14a.01[02] a process is implemented for ensuring that organizational plans for conducting security testing, training, and monitoring activities associated with organizational systems are maintained;
    • PM-14a.01[03] a process is implemented for ensuring that organizational plans for conducting privacy testing, training, and monitoring activities associated with organizational systems are developed;
    • PM-14a.01[04] a process is implemented for ensuring that organizational plans for conducting privacy testing, training, and monitoring activities associated with organizational systems are maintained;
  • PM-14a.02
    • PM-14a.02[01] a process is implemented for ensuring that organizational plans for conducting security testing, training, and monitoring activities associated with organizational systems continue to be executed;
    • PM-14a.02[02] a process is implemented for ensuring that organizational plans for conducting privacy testing, training, and monitoring activities associated with organizational systems continue to be executed;
• PM-14b.
  • PM-14b.[01] testing plans are reviewed for consistency with the organizational risk management strategy;
  • PM-14b.[02] training plans are reviewed for consistency with the organizational risk management strategy;
  • PM-14b.[03] monitoring plans are reviewed for consistency with the organizational risk management strategy;
  • PM-14b.[04] testing plans are reviewed for consistency with organization-wide priorities for risk response actions;
  • PM-14b.[05] training plans are reviewed for consistency with organization-wide priorities for risk response actions;
  • PM-14b.[06] monitoring plans are reviewed for consistency with organization-wide priorities for risk response actions.

Assessment Methods

Examine

• Information security program plan
• privacy program plan
• plans for conducting security and privacy testing, training, and monitoring activities
• organizational procedures addressing the development and maintenance of plans for conducting security and privacy testing, training, and monitoring activities
• risk management strategy
• procedures for the review of plans for conducting security and privacy testing, training, and monitoring activities for consistency with risk management strategy and risk response priorities
• results of risk assessments associated with conducting security and privacy testing, training, and monitoring activities
• documentation of the timely execution of plans for conducting security and privacy testing, training, and monitoring activities
• other relevant documents or records

Interview

• Organizational personnel with responsibilities for developing and maintaining plans for conducting security and privacy testing, training, and monitoring activities
• organizational personnel with information security and privacy responsibilities

Test

• Organizational processes for the development and maintenance of plans for conducting security and privacy testing, training, and monitoring activities
• mechanisms supporting the development and maintenance of plans for conducting security and privacy testing, training, and monitoring activities

Assessment Objective

Determine if:

• PM-17a.
  • PM-17a.[01] policy is established to ensure that requirements for the protection of controlled unclassified information that is processed, stored, or transmitted on external systems are implemented in accordance with applicable laws, executive orders, directives, policies, regulations, and standards;
  • PM-17a.[02] procedures are established to ensure that requirements for the protection of controlled unclassified information that is processed, stored, or transmitted on external systems are implemented in accordance with applicable laws, executive orders, directives, policies, regulations, and standards;
• PM-17b.
  • PM-17b.[01] policy is reviewed and updated [Assignment: frequency];
  • PM-17b.[02] procedures are reviewed and updated [Assignment: frequency]

Assessment Methods

Examine

• Controlled unclassified information policy
• controlled unclassified information procedures
• other relevant documents or records.

Interview

• Organizational personnel with controlled unclassified information responsibilities
• organizational personnel with information security responsibilities.

Assessment Objective

Determine if:

• PM-18a.
  • PM-18a.[01] an organization-wide privacy program plan that provides an overview of the agency’s privacy program is developed;
  • PM-18a.01
    • PM-18a.01[01] the privacy program plan includes a description of the structure of the privacy program;
    • PM-18a.01[02] the privacy program plan includes a description of the resources dedicated to the privacy program;
  • PM-18a.02
    • PM-18a.02[01] the privacy program plan provides an overview of the requirements for the privacy program;
    • PM-18a.02[02] the privacy program plan provides a description of the privacy program management controls in place or planned for meeting the requirements of the privacy program;
    • PM-18a.02[03] the privacy program plan provides a description of common controls in place or planned for meeting the requirements of the privacy program;
  • PM-18a.03
    • PM-18a.03[01] the privacy program plan includes the role of the senior agency official for privacy;
    • PM-18a.03[02] the privacy program plan includes the identification and assignment of the roles of other privacy officials and staff and their responsibilities;
  • PM-18a.04
    • PM-18a.04[01] the privacy program plan describes management commitment;
    • PM-18a.04[02] the privacy program plan describes compliance;
    • PM-18a.04[03] the privacy program plan describes the strategic goals and objectives of the privacy program;
  • PM-18a.05 the privacy program plan reflects coordination among organizational entities responsible for the different aspects of privacy;
  • PM-18a.06 the privacy program plan is approved by a senior official with responsibility and accountability for the privacy risk being incurred by organizational operations (including, mission, functions, image, and reputation), organizational assets, individuals, other organizations, and the Nation;
  • PM-18a.[02] the privacy program plan is disseminated;
• PM-18b.
  • PM-18b.[01] the privacy program plan is updated [Assignment: frequency];
  • PM-18b.[02] the privacy program plan is updated to address changes in federal privacy laws and policies;
  • PM-18b.[03] the privacy program plan is updated to address organizational changes;
  • PM-18b.[04] the privacy program plan is updated to address problems identified during plan implementation or privacy control assessments.

Assessment Methods

Examine

• Privacy program plan
• procedures addressing program plan development and implementation
• procedures addressing program plan reviews, updates, and approvals
• procedures addressing coordination of the program plan with relevant entities
• records of program plan reviews, updates, and approvals
• other relevant documents or records

Interview

• Organizational personnel with privacy program planning and plan implementation responsibilities
• organizational personnel with privacy responsibilities

Assessment Objective

Determine if:

• PM-19[01] a senior agency official for privacy with authority, mission, accountability, and resources is appointed;
• PM-19[02] the senior agency official for privacy coordinates applicable privacy requirements;
• PM-19[03] the senior agency official for privacy develops applicable privacy requirements;
• PM-19[04] the senior agency official for privacy implements applicable privacy requirements;
• PM-19[05] the senior agency official for privacy manages privacy risks through the organization-wide privacy program.

Assessment Methods

Examine

• Privacy program documents, including policies, procedures, plans, and reports
• public privacy notices, including Federal Register notices
• privacy impact assessments
• privacy risk assessments
• Privacy Act statements
• system of records notices
• computer matching agreements and notices
• contracts, information sharing agreements, and memoranda of understanding
• governing requirements, including laws, executive orders, regulations, standards, and guidance
• other relevant documents or records

Interview

• Organizational personnel with privacy program planning and plan implementation responsibilities
• organizational personnel with privacy responsibilities
• senior agency official for privacy
• privacy officials

Assessment Objective

Determine if:

• PM-20[01] a central resource webpage is maintained on the organization’s principal public website;
• PM-20[02] the webpage serves as a central source of information about the organization’s privacy program;
• PM-20a.
  • PM-20a.[01] the webpage ensures that the public has access to information about organizational privacy activities;
  • PM-20a.[02] the webpage ensures that the public can communicate with its senior agency official for privacy;
• PM-20b.
  • PM-20b.[01] the webpage ensures that organizational privacy practices are publicly available;
  • PM-20b.[02] the webpage ensures that organizational privacy reports are publicly available;
• PM-20c. the webpage employs publicly facing email addresses and/or phone numbers to enable the public to provide feedback and/or direct questions to privacy offices regarding privacy practices.

Assessment Methods

Examine

• Public website
• publicly posted privacy program documents, including policies, procedures, plans, and reports
• position description of the senior agency official for privacy
• public privacy notices, including Federal Register notices
• privacy impact assessments
• privacy risk assessments
• Privacy Act statements and system of records notices
• computer matching agreements and notices
• other relevant documents or records

Interview

• Organizational personnel with privacy program information dissemination responsibilities
• organizational personnel with privacy responsibilities

Test

• Location, access, availability, and functionality of privacy resource webpage

Assessment Objective

Determine if:

• PM-20(01)[01] privacy policies are developed and posted on all external-facing websites;
• PM-20(01)[02] privacy policies are developed and posted on all mobile applications;
• PM-20(01)[03] privacy policies are developed and posted on all other digital services;
• PM-20(01)(a)
  • PM-20(01)(a)[01] the privacy policies are written in plain language;
  • PM-20(01)(a)[02] the privacy policies are organized in a way that is easy to understand and navigate;
• PM-20(01)(b)
  • PM-20(01)(b)[01] the privacy policies provide the information needed by the public to make an informed decision about whether to interact with the organization;
  • PM-20(01)(b)[02] the privacy policies provide the information needed by the public to make an informed decision about how to interact with the organization;
• PM-20(01)(c)
  • PM-20(01)(c)[01] the privacy policies are updated whenever the organization makes a substantive change to the practices it describes;
  • PM-20(01)(c)[02] the privacy policies include a time/date stamp to inform the public of the date of the most recent changes.

Assessment Methods

Examine

• Privacy program plan
• privacy policies on the agency website, mobile applications, and/or other digital services

Interview

• Organizational personnel with privacy program information dissemination responsibilities
• organizational personnel with privacy responsibilities

Test

• Organizational procedures and practices for authorizing, conducting, managing, and reviewing personally identifiable information processing
• organizational procedures and practices for disseminating privacy program information
• mechanisms supporting the dissemination of privacy program information

Assessment Objective

Determine if:

• PM-21a. an accurate accounting of disclosures of personally identifiable information is developed and maintained;
  • PM-21a.01
    • PM-21a.01[01] the accounting includes the date of each disclosure;
    • PM-21a.01[02] the accounting includes the nature of each disclosure;
    • PM-21a.01[03] the accounting includes the purpose of each disclosure;
  • PM-21a.02
    • PM-21a.02[01] the accounting includes the name of the individual or organization to whom the disclosure was made;
    • PM-21a.02[02] the accounting includes the address or other contact information of the individual or organization to whom the disclosure was made;
• PM-21b. the accounting of disclosures is retained for the length of time that the personally identifiable information is maintained or five years after the disclosure is made, whichever is longer;
• PM-21c. the accounting of disclosures is made available to the individual to whom the personally identifiable information relates upon request.

Assessment Methods

Examine

• Privacy program plan
• disclosure policies and procedures
• records of disclosures
• audit logs
• Privacy Act policies and procedures
• system of records notice
• Privacy Act exemption rules.

Interview

• Organizational personnel with privacy program responsibilities
• organizational personnel with privacy responsibilities.

Test

• Organizational processes for disclosures
• mechanisms supporting the accounting of disclosures, including commercial services that provide notifications and alerts.

Assessment Objective

Determine if:

• PM-22[01] organization-wide policies for personally identifiable information quality management are developed and documented;
• PM-22[02] organization-wide procedures for personally identifiable information quality management are developed and documented;
• PM-22a.
  • PM-22a.[01] the policies address reviewing the accuracy of personally identifiable information across the information life cycle;
  • PM-22a.[02] the policies address reviewing the relevance of personally identifiable information across the information life cycle;
  • PM-22a.[03] the policies address reviewing the timeliness of personally identifiable information across the information life cycle;
  • PM-22a.[04] the policies address reviewing the completeness of personally identifiable information across the information life cycle;
  • PM-22a.[05] the procedures address reviewing the accuracy of personally identifiable information across the information life cycle;
  • PM-22a.[06] the procedures address reviewing the relevance of personally identifiable information across the information life cycle;
  • PM-22a.[07] the procedures address reviewing the timeliness of personally identifiable information across the information life cycle;
  • PM-22a.[08] the procedures address reviewing the completeness of personally identifiable information across the information life cycle;
• PM-22b.
  • PM-22b.[01] the policies address correcting or deleting inaccurate or outdated personally identifiable information;
  • PM-22b.[02] the procedures address correcting or deleting inaccurate or outdated personally identifiable information;
• PM-22c.
  • PM-22c.[01] the policies address disseminating notice of corrected or deleted personally identifiable information to individuals or other appropriate entities;
  • PM-22c.[02] the procedures address disseminating notice of corrected or deleted personally identifiable information to individuals or other appropriate entities;
• PM-22d.
  • PM-22d.[01] the policies address appeals of adverse decisions on correction or deletion requests;
  • PM-22d.[02] the procedures address appeals of adverse decisions on correction or deletion requests.

Assessment Methods

Examine

• Privacy program plan
• policies and procedures addressing personally identifiable information quality management, information life cycle documentation, and sample notices of correction or deletion
• records of monitoring PII quality management practices
• documentation of reviews and updates of policies and procedures

Interview

• Organizational personnel with privacy program information dissemination responsibilities
• organizational personnel with privacy responsibilities

Test

• [Organizational processes for data quality and personally identifiable information quality management procedures
• mechanisms supporting and/or implementing quality management requirements

Assessment Objective

Determine if:

• PM-24 a Data Integrity Board is established;
  • PM-24a. the Data Integrity Board reviews proposals to conduct or participate in a matching program;
  • PM-24b. the Data Integrity Board conducts an annual review of all matching programs in which the agency has participated.

Assessment Methods

Examine

• Privacy program plan
• privacy program documents relating to the Data Integrity Board, including documents establishing the board, its charter of operations, and any plans and reports
• computer matching agreements and notices
• information sharing agreements
• memoranda of understanding
• records documenting annual reviews
• governing requirements, including laws, executive orders, regulations, standards, and guidance

Interview

• members of the Data Integrity Board (e.g., the chief information officer, senior information security officer, senior agency official for privacy, and agency Inspector General)

Assessment Objective

Determine if:

• PM-25a.
  • PM-25a.[01] policies that address the use of personally identifiable information for internal testing are developed and documented;
  • PM-25a.[02] policies that address the use of personally identifiable information for internal training are developed and documented;
  • PM-25a.[03] policies that address the use of personally identifiable information for internal research are developed and documented;
  • PM-25a.[04] procedures that address the use of personally identifiable information for internal testing are developed and documented;
  • PM-25a.[05] procedures that address the use of personally identifiable information for internal training are developed and documented;
  • PM-25a.[06] procedures that address the use of personally identifiable information for internal research are developed and documented;
  • PM-25a.[07] policies that address the use of personally identifiable information for internal testing, are implemented;
  • PM-25a.[08] policies that address the use of personally identifiable information for training are implemented;
  • PM-25a.[09] policies that address the use of personally identifiable information for research are implemented;
  • PM-25a.[10] procedures that address the use of personally identifiable information for internal testing are implemented;
  • PM-25a.[11] procedures that address the use of personally identifiable information for training are implemented;
  • PM-25a.[12] procedures that address the use of personally identifiable information for research are implemented;
• PM-25b.
  • PM-25b.[01] the amount of personally identifiable information used for internal testing purposes is limited or minimized;
  • PM-25b.[02] the amount of personally identifiable information used for internal training purposes is limited or minimized;
  • PM-25b.[03] the amount of personally identifiable information used for internal research purposes is limited or minimized;
• PM-25c.
  • PM-25c.[01] the required use of personally identifiable information for internal testing is authorized;
  • PM-25c.[02] the required use of personally identifiable information for internal training is authorized;
  • PM-25c.[03] the required use of personally identifiable information for internal research is authorized;
• PM-25d.
  • PM-25d.[01] policies are reviewed [Assignment: frequency];
  • PM-25d.[02] policies are updated [Assignment: frequency];
  • PM-25d.[03] procedures are reviewed [Assignment: frequency];
  • PM-25d.[04] procedures are updated [Assignment: frequency].

Assessment Methods

Examine

• Privacy program plan
• policies and procedures for the minimization of personally identifiable information used in testing, training, and research
• documentation supporting policy implementation (e.g., templates for testing, training, and research
• privacy threshold analysis
• privacy risk assessment)
• data sets used for testing, training, and research

Interview

• Organizational personnel with privacy program responsibilities
• organizational personnel with privacy responsibilities
• system developers
• personnel with IRB responsibilities

Test

• Organizational processes for data quality and personally identifiable information management
• mechanisms supporting data quality management and personally identifiable information management to minimize the use of personally identifiable information

Assessment Objective

Determine if:

• PM-26[01] a process for receiving complaints, concerns, or questions from individuals about organizational security and privacy practices is implemented;
• PM-26[02] a process for responding to complaints, concerns, or questions from individuals about organizational security and privacy practices is implemented;
• PM-26a.
  • PM-26a.[01] the complaint management process includes mechanisms that are easy to use by the public;
  • PM-26a.[02] the complaint management process includes mechanisms that are readily accessible by the public;
• PM-26b. the complaint management process includes all information necessary for successfully filing complaints;
• PM-26c.
  • PM-26c.[01] the complaint management process includes tracking mechanisms to ensure that all complaints are reviewed within [Assignment: time period];
  • PM-26c.[02] the complaint management process includes tracking mechanisms to ensure that all complaints are addressed within [Assignment: time period];
• PM-26d. the complaint management process includes acknowledging the receipt of complaints, concerns, or questions from individuals within [Assignment: time period];
• PM-26e. the complaint management process includes responding to complaints, concerns, or questions from individuals within [Assignment: time period].

Assessment Methods

Examine

• Privacy program plan
• procedures addressing complaint management
• complaint documentation
• procedures addressing the reviews of complaints
• other relevant documents or records

Interview

• Organizational personnel with privacy program responsibilities
• organizational personnel with privacy responsibilities

Test

• Organizational processes for complaint management
• mechanisms supporting complaint management
• tools used by the public to submit complaints, concerns, and questions (e.g., telephone, hotline, email, or web-based forms

Assessment Objective

Determine if:

• PM-27a. [Assignment: privacy reports] are developed;
  • PM-27a.01 the privacy reports are disseminated to [Assignment: oversight bodies] to demonstrate accountability with statutory, regulatory, and policy privacy mandates;
  • PM-27a.02
    • PM-27a.02[01] the privacy reports are disseminated to [Assignment: officials];
    • PM-27a.02[02] the privacy reports are disseminated to other personnel responsible for monitoring privacy program compliance;
• PM-27b. the privacy reports are reviewed and updated [Assignment: frequency].

Assessment Methods

Examine

• Privacy program plan
• internal and external privacy reports
• privacy program plan
• annual senior agency official for privacy reports to OMB
• reports to Congress required by law, regulation, or policy, including internal policies
• records documenting the dissemination of reports to oversight bodies and officials responsible for monitoring privacy program compliance
• records of review and updates of privacy reports.

Interview

• Organizational personnel with privacy program responsibilities
• organizational personnel with privacy responsibilities
• legal counsel.

Assessment Objective

Determine if:

• PM-28a.
  • PM-28a.01
    • PM-28a.01[01] assumptions affecting risk assessments are identified and documented;
    • PM-28a.01[02] assumptions affecting risk responses are identified and documented;
    • PM-28a.01[03] assumptions affecting risk monitoring are identified and documented;
  • PM-28a.02
    • PM-28a.02[01] constraints affecting risk assessments are identified and documented;
    • PM-28a.02[02] constraints affecting risk responses are identified and documented;
    • PM-28a.02[03] constraints affecting risk monitoring are identified and documented;
  • PM-28a.03
    • PM-28a.03[01] priorities considered by the organization for managing risk are identified and documented;
    • PM-28a.03[02] trade-offs considered by the organization for managing risk are identified and documented;
  • PM-28a.04 organizational risk tolerance is identified and documented;
• PM-28b. the results of risk framing activities are distributed to [Assignment: personnel];
• PM-28c. risk framing considerations are reviewed and updated [Assignment: frequency].

Assessment Methods

Examine

• Information security program plan
• privacy program plan
• supply chain risk management strategy
• documentation of risk framing activities
• policies and procedures for risk framing activities
• risk management strategy

Interview

• Organizational personnel (including mission, business, and system owners or stewards
• authorizing officials
• senior agency information security officer
• senior agency official for privacy
• and senior accountable official for risk management)

Test

• Organizational procedures and practices for authorizing, conducting, managing, and reviewing personally identifiable information processing
• organizational processes for risk framing
• mechanisms supporting the development, review, update, and approval of risk framing

Assessment Objective

Determine if:

• PM-31 an organization-wide continuous monitoring strategy is developed;
  • PM-31a. continuous monitoring programs are implemented that include establishing [Assignment: metrics] to be monitored;
  • PM-31b.
    • PM-31b.[01] continuous monitoring programs are implemented that establish [Assignment: monitoring frequencies] for monitoring;
    • PM-31b.[02] continuous monitoring programs are implemented that establish [Assignment: assessment frequencies] for assessment of control effectiveness;
  • PM-31c. continuous monitoring programs are implemented that include monitoring [Assignment: metrics] on an ongoing basis in accordance with the continuous monitoring strategy;
  • PM-31d.
    • PM-31d.[01] continuous monitoring programs are implemented that include correlating information generated by control assessments and monitoring;
    • PM-31d.[02] continuous monitoring programs are implemented that include analyzing information generated by control assessments and monitoring;
  • PM-31e.
    • PM-31e.[01] continuous monitoring programs are implemented that include response actions to address the analysis of control assessment information;
    • PM-31e.[02] continuous monitoring programs are implemented that include response actions to address the analysis of monitoring information;
  • PM-31f.
    • PM-31f.[01] continuous monitoring programs are implemented that include reporting the security status of organizational systems to [Assignment: personnel or roles] [Assignment: frequency];
    • PM-31f.[02] continuous monitoring programs are implemented that include reporting the privacy status of organizational systems to [Assignment: personnel or roles] [Assignment: frequency].

Assessment Methods

Examine

• Information security program plan
• privacy program plan
• supply chain risk management plan
• continuous monitoring strategy
• risk management strategy
• information security continuous monitoring program documentation, reporting, metrics, and artifacts
• information security continuous monitoring program assessment documentation, reporting, metrics, and artifacts
• assessment and authorization policy
• procedures addressing the continuous monitoring of controls
• privacy program continuous monitoring documentation, reporting, metrics, and artifacts
• continuous monitoring program records, security, and privacy impact analyses
• status reports
• risk response documentation
• other relevant documents or records.

Interview

• Senior Accountable Official for Risk Management
• chief information officer
• senior agency information security officer
• senior agency official for privacy
• organizational personnel with information security, privacy, and supply chain risk management program responsibilities

Test

• Organizational procedures and mechanisms used for information security, privacy, and supply chain continuous monitoring

Assessment Objective

Determine if:

• PS-06a. access agreements are developed and documented for organizational systems;
• PS-06b. the access agreements are reviewed and updated [Assignment: frequency];
• PS-06c.
  • PS-06c.01 individuals requiring access to organizational information and systems sign appropriate access agreements prior to being granted access;
  • PS-06c.02 individuals requiring access to organizational information and systems re-sign access agreements to maintain access to organizational systems when access agreements have been updated or [Assignment: frequency].

Assessment Methods

Examine

• Personnel security policy
• personnel security procedures
• procedures addressing access agreements for organizational information and systems
• access control policy
• access control procedures
• access agreements (including non-disclosure agreements, acceptable use agreements, rules of behavior, and conflict-of-interest agreements)
• documentation of access agreement reviews, updates, and re-signing
• system security plan
• privacy plan
• other relevant documents or records

Interview

• Organizational personnel with personnel security responsibilities
• organizational personnel who have signed/resigned access agreements
• organizational personnel with information security and privacy responsibilities

Test

• Organizational processes for reviewing, updating, and re-signing access agreements
• mechanisms supporting the reviewing, updating, and re-signing of access agreements

Assessment Objective

Determine if:

• PT-01a.
  • PT-01a.[01] a personally identifiable information processing and transparency policy is developed and documented;
  • PT-01a.[02] the personally identifiable information processing and transparency policy is disseminated to [Assignment: personnel or roles];
  • PT-01a.[03] personally identifiable information processing and transparency procedures to facilitate the implementation of the personally identifiable information processing and transparency policy and associated personally identifiable information processing and transparency controls are developed and documented;
  • PT-01a.[04] the personally identifiable information processing and transparency procedures are disseminated to [Assignment: personnel or roles];
  • PT-01a.01
    • PT-01a.01(a)
      • PT-01a.01(a)[01] the [Selection (one or more): organization-level; mission/business process-level; system-level] personally identifiable information processing and transparency policy addresses purpose;
      • PT-01a.01(a)[02] the [Selection (one or more): organization-level; mission/business process-level; system-level] personally identifiable information processing and transparency policy addresses scope;
      • PT-01a.01(a)[03] the [Selection (one or more): organization-level; mission/business process-level; system-level] personally identifiable information processing and transparency policy addresses roles;
      • PT-01a.01(a)[04] the [Selection (one or more): organization-level; mission/business process-level; system-level] personally identifiable information processing and transparency policy addresses responsibilities;
      • PT-01a.01(a)[05] the [Selection (one or more): organization-level; mission/business process-level; system-level] personally identifiable information processing and transparency policy addresses management commitment;
      • PT-01a.01(a)[06] the [Selection (one or more): organization-level; mission/business process-level; system-level] personally identifiable information processing and transparency policy addresses coordination among organizational entities;
      • PT-01a.01(a)[07] the [Selection (one or more): organization-level; mission/business process-level; system-level] personally identifiable information processing and transparency policy addresses compliance;
    • PT-01a.01(b) the [Selection (one or more): organization-level; mission/business process-level; system-level] personally identifiable information processing and transparency policy is consistent with applicable laws, Executive Orders, directives, regulations, policies, standards, and guidelines;
• PT-01b. the [Assignment: official] is designated to manage the development, documentation, and dissemination of the personally identifiable information processing and transparency policy and procedures;
• PT-01c.
  • PT-01c.01
    • PT-01c.01[01] the current personally identifiable information processing and transparency policy is reviewed and updated [Assignment: frequency];
    • PT-01c.01[02] the current personally identifiable information processing and transparency policy is reviewed and updated following [Assignment: events];
  • PT-01c.02
    • PT-01c.02[01] the current personally identifiable information processing and transparency procedures are reviewed and updated [Assignment: frequency];
    • PT-01c.02[02] the current personally identifiable information processing and transparency procedures are reviewed and updated following [Assignment: events].

Assessment Methods

Examine

• Personally identifiable information processing and transparency policy and procedures
• privacy plan
• privacy program plan
• other relevant documents or records

Interview

• Organizational personnel with personally identifiable information processing and transparency responsibilities
• organizational personnel with information security and privacy responsibilities

Assessment Objective

Determine if:

• PT-02a. the [Assignment: authority] that permits the [Assignment: processing] of personally identifiable information is determined and documented;
• PT-02b. the [Assignment: processing] of personally identifiable information is restricted to only that which is authorized.

Assessment Methods

Examine

• Personally identifiable information processing and transparency policy and procedures
• privacy plan
• other relevant documents or records

Interview

• Organizational personnel with personally identifiable information processing and transparency responsibilities
• organizational personnel with information security and privacy responsibilities

Test

• Organizational processes for authorizing the processing of personally identifiable information
• mechanisms supporting and/or implementing the restriction of personally identifiable information processing

Assessment Objective

Determine if:

• PT-03a. the [Assignment: purpose(s)] for processing personally identifiable information is/are identified and documented;
• PT-03b.
  • PT-03b.[01] the purpose(s) is/are described in the public privacy notices of the organization;
  • PT-03b.[02] the purpose(s) is/are described in the policies of the organization;
• PT-03c. the [Assignment: processing] of personally identifiable information are restricted to only that which is compatible with the identified purpose(s);
• PT-03d.
  • PT-03d.[01] changes in the processing of personally identifiable information are monitored;
  • PT-03d.[02] [Assignment: mechanisms] are implemented to ensure that any changes are made in accordance with [Assignment: requirements].

Assessment Methods

Examine

• Personally identifiable information processing and transparency policy and procedures
• configuration management plan
• organizational privacy notices
• organizational policies
• Privacy Act statements
• computer matching notices
• applicable Federal Register notices
• documented requirements for enforcing and monitoring the processing of personally identifiable information
• privacy plan
• other relevant documents or records

Interview

• Organizational personnel with personally identifiable information processing and transparency responsibilities
• organizational personnel with information security and privacy responsibilities

Test

• Organizational processes for authorizing the processing of personally identifiable information
• mechanisms supporting and/or implementing the management of authorized personally identifiable information processing
• organizational processes for monitoring changes in processing personally identifiable information

Assessment Objective

Determine if:

• PT-04 the [Assignment: tools or mechanisms] are implemented for individuals to consent to the processing of their personally identifiable information prior to its collection that facilitate individuals’ informed decision-making.

Assessment Methods

Examine

• Personally identifiable information processing and transparency policy and procedures
• consent policies and procedures
• consent tools and mechanisms
• consent presentation or display (user interface)
• evidence of individuals’ consent
• privacy plan
• other relevant documents or records

Interview

• Organizational personnel with personally identifiable information processing and transparency responsibilities
• organizational personnel with information security and privacy responsibilities

Test

• Organizational processes for the collection of personally identifiable information
• consent tools or mechanisms for users to authorize the processing of their personally identifiable information
• mechanisms implementing consent

Assessment Objective

Determine if:

• PT-05a.
  • PT-05a.[01] a notice to individuals about the processing of personally identifiable information is provided such that the notice is available to individuals upon first interacting with an organization;
  • PT-05a.[02] a notice to individuals about the processing of personally identifiable information is provided such that the notice is subsequently available to individuals [Assignment: frequency];
• PT-05b. a notice to individuals about the processing of personally identifiable information is provided that is clear, easy-to-understand, and expresses information about personally identifiable information processing in plain language;
• PT-05c. a notice to individuals about the processing of personally identifiable information that identifies the authority that authorizes the processing of personally identifiable information is provided;
• PT-05d. a notice to individuals about the processing of personally identifiable information that identifies the purpose for which personally identifiable information is to be processed is provided;
• PT-05e. a notice to individuals about the processing of personally identifiable information which includes [Assignment: information] is provided.

Assessment Methods

Examine

• Personally identifiable information processing and transparency policy and procedures
• privacy notice
• Privacy Act statements
• privacy plan
• other relevant documents or records

Interview

• Organizational personnel with personally identifiable information processing and transparency responsibilities
• organizational personnel with user interface or user experience responsibilities
• organizational personnel with information security and privacy responsibilities

Test

• Organizational processes and implementation support or mechanisms for providing notice to individuals regarding the processing of their personally identifiable information

Assessment Objective

Determine if:

• PT-05(02) Privacy Act statements are included on forms that collect information that will be maintained in a Privacy Act system of records, or Privacy Act statements are provided on separate forms that can be retained by individuals.

Assessment Methods

Examine

• Personally identifiable information processing and transparency policy and procedures
• privacy notice
• Privacy Act system of records
• forms that include Privacy Act statements
• privacy plan
• other relevant documents or records

Interview

• Organizational personnel with personally identifiable information processing and transparency responsibilities
• organizational personnel with information security and privacy responsibilities

Test

• Organizational processes for including Privacy Act statements on forms that collect information or on separate forms that can be retained by individuals

Assessment Objective

Determine if:

• PT-06a.
  • PT-06a.[01] system of records notices are drafted in accordance with OMB guidance for systems that process information that will be maintained in a Privacy Act system of records;
  • PT-06a.[02] new and significantly modified system of records notices are submitted to the OMB and appropriate congressional committees for advance review for systems that process information that will be maintained in a Privacy Act system of records;
• PT-06b. system of records notices are published in the Federal Register for systems that process information that will be maintained in a Privacy Act system of records;
• PT-06c. system of records notices are kept accurate, up-to-date, and scoped in accordance with policy for systems that process information that will be maintained in a Privacy Act system of records.

Assessment Methods

Examine

• Personally identifiable information processing and transparency policy and procedures
• privacy notice
• Privacy Act system of records
• Federal Register notices
• privacy plan
• other relevant documents or records

Interview

• Organizational personnel with personally identifiable information processing and transparency responsibilities
• organizational personnel with information security and privacy responsibilities

Test

• Organizational processes for Privacy Act system of records maintenance

Assessment Objective

Determine if:

• PT-06(01) all routine uses published in the system of records notice are reviewed [Assignment: frequency] to ensure continued accuracy, and to ensure that routine uses continue to be compatible with the purpose for which the information was collected.

Assessment Methods

Examine

• Personally identifiable information processing and transparency policy and procedures
• privacy notice
• Privacy Act system of records
• privacy plan
• other relevant documents or records

Interview

• Organizational personnel with personally identifiable information processing and transparency responsibilities
• organizational personnel with information security and privacy responsibilities

Test

• Organizational processes for reviewing system of records notices

Assessment Objective

Determine if:

• PT-06(02)[01] all Privacy Act exemptions claimed for the system of records are reviewed [Assignment: frequency] to ensure that they remain appropriate and necessary in accordance with law;
• PT-06(02)[02] all Privacy Act exemptions claimed for the system of records are reviewed [Assignment: frequency] to ensure that they have been promulgated as regulations;
• PT-06(02)[03] all Privacy Act exemptions claimed for the system of records are reviewed [Assignment: frequency] to ensure that they are accurately described in the system of records notice.

Assessment Methods

Examine

• Personally identifiable information processing and transparency policy and procedures
• privacy notice
• Privacy Act system of records
• Privacy Act exemptions
• privacy plan
• other relevant documents or records

Interview

• Organizational personnel with personally identifiable information processing and transparency responsibilities
• organizational personnel with information security and privacy responsibilities

Test

• Organizational processes for Privacy Act system of records maintenance

Assessment Objective

Determine if:

• PT-07 [Assignment: processing conditions] are applied for specific categories of personally identifiable information.

Assessment Methods

Examine

• Personally identifiable information processing and transparency policy and procedures
• privacy notice
• Privacy Act system of records
• computer matching agreements and notices
• contracts
• privacy information sharing agreements
• memoranda of understanding
• governing requirements
• privacy plan
• other relevant documents or records

Interview

• Organizational personnel with personally identifiable information processing and transparency responsibilities
• organizational personnel with information security and privacy responsibilities

Test

• Organizational processes for supporting and/or implementing personally identifiable information processing

Assessment Objective

Determine if:

• PT-07(01)(a)
  • PT-07(01)(a)[01] when a system processes Social Security numbers, the unnecessary collection, maintenance, and use of Social Security numbers are eliminated;
  • PT-07(01)(a)[02] when a system processes Social Security numbers, alternatives to the use of Social Security Numbers as a personal identifier are explored;
• PT-07(01)(b) when a system processes Social Security numbers, individual rights, benefits, or privileges provided by law are not denied because of an individual’s refusal to disclose their Social Security number;
• PT-07(01)(c)
  • PT-07(01)(c)[01] when a system processes Social Security numbers, any individual who is asked to disclose their Social Security number is informed whether that disclosure is mandatory or voluntary, by what statutory or other authority such number is solicited, and what uses will be made of it;
  • PT-07(01)(c)[02] when a system processes Social Security numbers, any individual who is asked to disclose their Social Security number is informed by what statutory or other authority the number is solicited;
  • PT-07(01)(c)[03] when a system processes Social Security numbers, any individual who is asked to disclose their Social Security number is informed what uses will be made of it.

Assessment Methods

Examine

• Personally identifiable information processing and transparency policy and procedures
• privacy notice
• Privacy Act system of records
• privacy notice
• separate notice regarding the use of Social Security numbers
• privacy plan
• other relevant documents or records

Interview

• Organizational personnel with personally identifiable information processing and transparency responsibilities
• organizational personnel with information security and privacy responsibilities

Test

• Organizational processes for identifying, reviewing, and taking action to control the unnecessary use of Social Security numbers
• implementation of an alternative to Social Security numbers as identifiers

Assessment Objective

Determine if:

• PT-07(02) the processing of information describing how any individual exercises rights guaranteed by the First Amendment is prohibited unless expressly authorized by statute or by the individual or unless pertinent to and within the scope of an authorized law enforcement activity.

Assessment Methods

Examine

• Personally identifiable information processing and transparency policy and procedures
• privacy notice
• Privacy Act system of records
• privacy plan
• other relevant documents or records

Interview

• Organizational personnel with personally identifiable information processing and transparency responsibilities
• organizational personnel with information security and privacy responsibilities

Test

• Organizational processes for supporting and/or implementing personally identifiable information processing

Assessment Objective

Determine if:

• PT-08a. approval to conduct the matching program is obtained from the Data Integrity Board when a system or organization processes information for the purpose of conducting a matching program;
• PT-08b.
  • PT-08b.[01] a computer matching agreement is developed when a system or organization processes information for the purpose of conducting a matching program;
  • PT-08b.[02] a computer matching agreement is entered into when a system or organization processes information for the purpose of conducting a matching program;
• PT-08c. a matching notice is published in the Federal Register when a system or organization processes information for the purpose of conducting a matching program;
• PT-08d. the information produced by the matching program is independently verified before taking adverse action against an individual, if required, when a system or organization processes information for the purpose of conducting a matching program;
• PT-08e.
  • PT-08e.[01] individuals are provided with notice when a system or organization processes information for the purpose of conducting a matching program;
  • PT-08e.[02] individuals are provided with an opportunity to contest the findings before adverse action is taken against them when a system or organization processes information for the purpose of conducting a matching program.

Assessment Methods

Examine

• Personally identifiable information processing and transparency policy and procedures
• privacy notice
• Privacy Act system of records
• Federal Register notices
• Data Integrity Board determinations
• contracts
• information sharing agreements
• memoranda of understanding
• governing requirements
• privacy plan
• other relevant documents or records

Interview

• Organizational personnel with personally identifiable information processing and transparency responsibilities
• organizational personnel with information security and privacy responsibilities

Test

• Organizational processes for supporting and/or implementing personally identifiable information processing
• matching program

Assessment Objective

Determine if:

• RA-01a.
  • RA-01a.[01] a risk assessment policy is developed and documented;
  • RA-01a.[02] the risk assessment policy is disseminated to [Assignment: personnel or roles];
  • RA-01a.[03] risk assessment procedures to facilitate the implementation of the risk assessment policy and associated risk assessment controls are developed and documented;
  • RA-01a.[04] the risk assessment procedures are disseminated to [Assignment: personnel or roles];
  • RA-01a.01
    • RA-01a.01(a)
      • RA-01a.01(a)[01] the [Selection (one or more): organization-level; mission/business process-level; system-level] risk assessment policy addresses purpose;
      • RA-01a.01(a)[02] the [Selection (one or more): organization-level; mission/business process-level; system-level] risk assessment policy addresses scope;
      • RA-01a.01(a)[03] the [Selection (one or more): organization-level; mission/business process-level; system-level] risk assessment policy addresses roles;
      • RA-01a.01(a)[04] the [Selection (one or more): organization-level; mission/business process-level; system-level] risk assessment policy addresses responsibilities;
      • RA-01a.01(a)[05] the [Selection (one or more): organization-level; mission/business process-level; system-level] risk assessment policy addresses management commitment;
      • RA-01a.01(a)[06] the [Selection (one or more): organization-level; mission/business process-level; system-level] risk assessment policy addresses coordination among organizational entities;
      • RA-01a.01(a)[07] the [Selection (one or more): organization-level; mission/business process-level; system-level] risk assessment policy addresses compliance;
    • RA-01a.01(b) the [Selection (one or more): organization-level; mission/business process-level; system-level] risk assessment policy is consistent with applicable laws, executive orders, directives, regulations, policies, standards, and guidelines;
• RA-01b. the [Assignment: official] is designated to manage the development, documentation, and dissemination of the risk assessment policy and procedures;
• RA-01c.
  • RA-01c.01
    • RA-01c.01[01] the current risk assessment policy is reviewed and updated [Assignment: frequency];
    • RA-01c.01[02] the current risk assessment policy is reviewed and updated following [Assignment: events];
  • RA-01c.02
    • RA-01c.02[01] the current risk assessment procedures are reviewed and updated [Assignment: frequency];
    • RA-01c.02[02] the current risk assessment procedures are reviewed and updated following [Assignment: events].

Assessment Methods

Examine

• Risk assessment policy and procedures
• system security plan
• privacy plan
• other relevant documents or records

Interview

• Organizational personnel with risk assessment responsibilities
• organizational personnel with security and privacy responsibilities

Assessment Objective

Determine if:

• RA-03a.
  • RA-03a.01 a risk assessment is conducted to identify threats to and vulnerabilities in the system;
  • RA-03a.02 a risk assessment is conducted to determine the likelihood and magnitude of harm from unauthorized access, use, disclosure, disruption, modification, or destruction of the system; the information it processes, stores, or transmits; and any related information;
  • RA-03a.03 a risk assessment is conducted to determine the likelihood and impact of adverse effects on individuals arising from the processing of personally identifiable information;
• RA-03b. risk assessment results and risk management decisions from the organization and mission or business process perspectives are integrated with system-level risk assessments;
• RA-03c. risk assessment results are documented in [Selection: security and privacy plans; risk assessment report; [Assignment: document] ];
• RA-03d. risk assessment results are reviewed [Assignment: frequency];
• RA-03e. risk assessment results are disseminated to [Assignment: personnel or roles];
• RA-03f. the risk assessment is updated [Assignment: frequency] or when there are significant changes to the system, its environment of operation, or other conditions that may impact the security or privacy state of the system.

Assessment Methods

Examine

• Risk assessment policy
• risk assessment procedures
• security and privacy planning policy and procedures
• procedures addressing organizational assessments of risk
• risk assessment
• risk assessment results
• risk assessment reviews
• risk assessment updates
• system security plan
• privacy plan
• other relevant documents or records

Interview

• Organizational personnel with risk assessment responsibilities
• organizational personnel with security and privacy responsibilities

Test

• Organizational processes for risk assessment
• mechanisms supporting and/or conducting, documenting, reviewing, disseminating, and updating the risk assessment

Assessment Objective

Determine if:

• RA-07[01] findings from security assessments are responded to in accordance with organizational risk tolerance;
• RA-07[02] findings from privacy assessments are responded to in accordance with organizational risk tolerance;
• RA-07[03] findings from monitoring are responded to in accordance with organizational risk tolerance;
• RA-07[04] findings from audits are responded to in accordance with organizational risk tolerance.

Assessment Methods

Examine

• Risk assessment policy
• assessment reports
• audit records/event logs
• system security plan
• privacy plan
• other relevant documents or records

Interview

• Organizational personnel with assessment and auditing responsibilities
• system/network administrators
• organizational personnel with security and privacy responsibilities

Test

• Organizational processes for assessments and audits
• mechanisms/tools supporting and/or implementing assessments and auditing

Assessment Objective

Determine if:

• RA-08a. privacy impact assessments are conducted for systems, programs, or other activities before developing or procuring information technology that processes personally identifiable information;
• RA-08b.
  • RA-08b.[01] privacy impact assessments are conducted for systems, programs, or other activities before initiating a collection of personally identifiable information that will be processed using information technology;
  • RA-08b.[02] privacy impact assessments are conducted for systems, programs, or other activities before initiating a collection of personally identifiable information that includes personally identifiable information permitting the physical or virtual (online) contacting of a specific individual, if identical questions have been posed to, or identical reporting requirements imposed on, ten or more individuals, other than agencies, instrumentalities, or employees of the federal government.

Assessment Methods

Examine

• Risk assessment policy
• security and privacy risk assessment reports
• acquisitions documents
• system security plan
• privacy plan
• other relevant documents or records

Interview

• Organizational personnel with assessment and auditing responsibilities
• system/network administrators
• system developers
• program managers
• legal counsel
• organizational personnel with security and privacy responsibilities

Test

• Organizational processes for assessments and audits
• mechanisms/tools supporting and/or implementing assessments and auditing

Assessment Objective

Determine if:

• SA-01a.
  • SA-01a.[01] a system and services acquisition policy is developed and documented;
  • SA-01a.[02] the system and services acquisition policy is disseminated to [Assignment: personnel or roles];
  • SA-01a.[03] system and services acquisition procedures to facilitate the implementation of the system and services acquisition policy and associated system and services acquisition controls are developed and documented;
  • SA-01a.[04] the system and services acquisition procedures are disseminated to [Assignment: personnel or roles];
  • SA-01a.01
    • SA-01a.01(a)
      • SA-01a.01(a)[01] the [Selection (one or more): organization-level; mission/business process-level; system-level] system and services acquisition policy addresses purpose;
      • SA-01a.01(a)[02] the [Selection (one or more): organization-level; mission/business process-level; system-level] system and services acquisition policy addresses scope;
      • SA-01a.01(a)[03] the [Selection (one or more): organization-level; mission/business process-level; system-level] system and services acquisition policy addresses roles;
      • SA-01a.01(a)[04] the [Selection (one or more): organization-level; mission/business process-level; system-level] system and services acquisition policy addresses responsibilities;
      • SA-01a.01(a)[05] the [Selection (one or more): organization-level; mission/business process-level; system-level] system and services acquisition policy addresses management commitment;
      • SA-01a.01(a)[06] the [Selection (one or more): organization-level; mission/business process-level; system-level] system and services acquisition policy addresses coordination among organizational entities;
      • SA-01a.01(a)[07] the [Selection (one or more): organization-level; mission/business process-level; system-level] system and services acquisition policy addresses compliance;
    • SA-01a.01(b) the [Selection (one or more): organization-level; mission/business process-level; system-level] system and services acquisition policy is consistent with applicable laws, Executive Orders, directives, regulations, policies, standards, and guidelines;
• SA-01b. the [Assignment: official] is designated to manage the development, documentation, and dissemination of the system and services acquisition policy and procedures;
• SA-01c.
  • SA-01c.01
    • SA-01c.01[01] the system and services acquisition policy is reviewed and updated [Assignment: frequency];
    • SA-01c.01[02] the current system and services acquisition policy is reviewed and updated following [Assignment: events];
  • SA-01c.02
    • SA-01c.02[01] the current system and services acquisition procedures are reviewed and updated [Assignment: frequency];
    • SA-01c.02[02] the current system and services acquisition procedures are reviewed and updated following [Assignment: events].

Assessment Methods

Examine

• System and services acquisition policy
• system and services acquisition procedures
• supply chain risk management policy
• supply chain risk management procedures
• supply chain risk management plan
• system security plan
• privacy plan
• other relevant documents or records

Interview

• Organizational personnel with system and services acquisition responsibilities
• organizational personnel with information security and privacy responsibilities
• organizational personnel with supply chain risk management responsibilities

Assessment Objective

Determine if:

• SA-02a.
  • SA-02a.[01] the high-level information security requirements for the system or system service are determined in mission and business process planning;
  • SA-02a.[02] the high-level privacy requirements for the system or system service are determined in mission and business process planning;
• SA-02b.
  • SA-02b.[01] the resources required to protect the system or system service are determined and documented as part of the organizational capital planning and investment control process;
  • SA-02b.[02] the resources required to protect the system or system service are allocated as part of the organizational capital planning and investment control process;
• SA-02c.
  • SA-02c.[01] a discrete line item for information security is established in organizational programming and budgeting documentation;
  • SA-02c.[02] a discrete line item for privacy is established in organizational programming and budgeting documentation.

Assessment Methods

Examine

• System and services acquisition policy
• system and services acquisition procedures
• system and services acquisition strategy and plans
• procedures addressing the allocation of resources to information security and privacy requirements
• procedures addressing capital planning and investment control
• organizational programming and budgeting documentation
• system security plan
• privacy plan
• supply chain risk management policy
• other relevant documents or records

Interview

• Organizational personnel with capital planning, investment control, organizational programming, and budgeting responsibilities
• organizational personnel with information security and privacy responsibilities
• organizational personnel with supply chain risk management responsibilities

Test

• Organizational processes for determining information security and privacy requirements
• organizational processes for capital planning, programming, and budgeting
• mechanisms supporting and/or implementing organizational capital planning, programming, and budgeting

Assessment Objective

Determine if:

• SA-03a.
  • SA-03a.[01] the system is acquired, developed, and managed using [Assignment: system-development life cycle] that incorporates information security considerations;
  • SA-03a.[02] the system is acquired, developed, and managed using [Assignment: system-development life cycle] that incorporates privacy considerations;
• SA-03b.
  • SA-03b.[01] information security roles and responsibilities are defined and documented throughout the system development life cycle;
  • SA-03b.[02] privacy roles and responsibilities are defined and documented throughout the system development life cycle;
• SA-03c.
  • SA-03c.[01] individuals with information security roles and responsibilities are identified;
  • SA-03c.[02] individuals with privacy roles and responsibilities are identified;
• SA-03d.
  • SA-03d.[01] organizational information security risk management processes are integrated into system development life cycle activities;
  • SA-03d.[02] organizational privacy risk management processes are integrated into system development life cycle activities.

Assessment Methods

Examine

• System and services acquisition policy
• system and services acquisition procedures
• procedures addressing the integration of information security and privacy and supply chain risk management into the system development life cycle process
• system development life cycle documentation
• organizational risk management strategy
• information security and privacy risk management strategy documentation
• system security plan
• privacy plan
• privacy program plan
• enterprise architecture documentation
• role-based security and privacy training program documentation
• data mapping documentation
• other relevant documents or records

Interview

• Organizational personnel with information security and privacy responsibilities
• organizational personnel with system life cycle development responsibilities
• organizational personnel with supply chain risk management responsibilities

Test

• Organizational processes for defining and documenting the system development life cycle
• organizational processes for identifying system development life cycle roles and responsibilities
• organizational processes for integrating information security and privacy and supply chain risk management into the system development life cycle
• mechanisms supporting and/or implementing the system development life cycle

Assessment Objective

Determine if:

• SA-04a.
  • SA-04a.[01] security functional requirements, descriptions, and criteria are included explicitly or by reference using [Selection (one or more): standardized contract language; [Assignment: contract language] ] in the acquisition contract for the system, system component, or system service;
  • SA-04a.[02] privacy functional requirements, descriptions, and criteria are included explicitly or by reference using [Selection (one or more): standardized contract language; [Assignment: contract language] ] in the acquisition contract for the system, system component, or system service;
• SA-04b. strength of mechanism requirements, descriptions, and criteria are included explicitly or by reference using [Selection (one or more): standardized contract language; [Assignment: contract language] ] in the acquisition contract for the system, system component, or system service;
• SA-04c.
  • SA-04c.[01] security assurance requirements, descriptions, and criteria are included explicitly or by reference using [Selection (one or more): standardized contract language; [Assignment: contract language] ] in the acquisition contract for the system, system component, or system service;
  • SA-04c.[02] privacy assurance requirements, descriptions, and criteria are included explicitly or by reference using [Selection (one or more): standardized contract language; [Assignment: contract language] ] in the acquisition contract for the system, system component, or system service;
• SA-04d.
  • SA-04d.[01] controls needed to satisfy the security requirements, descriptions, and criteria are included explicitly or by reference using [Selection (one or more): standardized contract language; [Assignment: contract language] ] in the acquisition contract for the system, system component, or system service;
  • SA-04d.[02] controls needed to satisfy the privacy requirements, descriptions, and criteria are included explicitly or by reference using [Selection (one or more): standardized contract language; [Assignment: contract language] ] in the acquisition contract for the system, system component, or system service;
• SA-04e.
  • SA-04e.[01] security documentation requirements, descriptions, and criteria are included explicitly or by reference using [Selection (one or more): standardized contract language; [Assignment: contract language] ] in the acquisition contract for the system, system component, or system service;
  • SA-04e.[02] privacy documentation requirements, descriptions, and criteria are included explicitly or by reference using [Selection (one or more): standardized contract language; [Assignment: contract language] ] in the acquisition contract for the system, system component, or system service;
• SA-04f.
  • SA-04f.[01] requirements for protecting security documentation, descriptions, and criteria are included explicitly or by reference using [Selection (one or more): standardized contract language; [Assignment: contract language] ] in the acquisition contract for the system, system component, or system service;
  • SA-04f.[02] requirements for protecting privacy documentation, descriptions, and criteria are included explicitly or by reference using [Selection (one or more): standardized contract language; [Assignment: contract language] ] in the acquisition contract for the system, system component, or system service;
• SA-04g. the description of the system development environment and environment in which the system is intended to operate, requirements, and criteria are included explicitly or by reference using [Selection (one or more): standardized contract language; [Assignment: contract language] ] in the acquisition contract for the system, system component, or system service;
• SA-04h.
  • SA-04h.[01] the allocation of responsibility or identification of parties responsible for information security requirements, descriptions, and criteria are included explicitly or by reference using [Selection (one or more): standardized contract language; [Assignment: contract language] ] in the acquisition contract for the system, system component, or system service;
  • SA-04h.[02] the allocation of responsibility or identification of parties responsible for privacy requirements, descriptions, and criteria are included explicitly or by reference using [Selection (one or more): standardized contract language; [Assignment: contract language] ];
  • SA-04h.[03] the allocation of responsibility or identification of parties responsible for supply chain risk management requirements, descriptions, and criteria are included explicitly or by reference using [Selection (one or more): standardized contract language; [Assignment: contract language] ];
• SA-04i. acceptance criteria requirements and descriptions are included explicitly or by reference using [Selection (one or more): standardized contract language; [Assignment: contract language] ] in the acquisition contract for the system, system component, or system service.

Assessment Methods

Examine

• System and services acquisition policy
• system and services acquisition procedures
• procedures addressing the integration of information security and privacy and supply chain risk management into the acquisition process
• configuration management plan
• acquisition contracts for the system, system component, or system service
• system design documentation
• system security plan
• supply chain risk management plan
• privacy plan
• other relevant documents or records

Interview

• Organizational personnel with acquisition/contracting responsibilities
• organizational personnel with information security and privacy responsibilities
• system/network administrators
• organizational personnel with supply chain risk management responsibilities

Test

• Organizational processes for determining system security and privacy functional, strength, and assurance requirements
• organizational processes for developing acquisition contracts
• mechanisms supporting and/or implementing acquisitions and the inclusion of security and privacy requirements in contracts

Assessment Objective

Determine if:

• SA-08(33) the privacy principle of minimization is implemented using [Assignment: processes].

Assessment Methods

Examine

• System and services acquisition policy
• system and services acquisition procedures
• personally identifiable information processing policy
• procedures addressing the minimization of personally identifiable information in system design
• system design documentation
• system configuration settings and associated documentation
• change control records
• information security and privacy requirements and specifications for the system
• system security and privacy architecture
• system security plan
• privacy plan
• privacy impact assessment
• privacy risk assessment documentation
• other relevant documents or records

Interview

• Organizational personnel with information security and privacy responsibilities
• organizational personnel with system specification, design, development, implementation, and modification responsibilities
• system developers

Test

• Organizational processes for applying the privacy design principle of minimization in system specification, design, development, implementation, and modification
• mechanisms supporting the application of the security design principle of sufficient documentation in system specification, design, development, implementation, and modification
• mechanisms that enforce security and privacy policy
• organizational processes for managing change configuration
• mechanisms supporting configuration control

Assessment Objective

Determine if:

• SA-09a.
  • SA-09a.[01] providers of external system services comply with organizational security requirements;
  • SA-09a.[02] providers of external system services comply with organizational privacy requirements;
  • SA-09a.[03] providers of external system services employ [Assignment: controls];
• SA-09b.
  • SA-09b.[01] organizational oversight with regard to external system services are defined and documented;
  • SA-09b.[02] user roles and responsibilities with regard to external system services are defined and documented;
• SA-09c. [Assignment: processes, methods, and techniques] are employed to monitor control compliance by external service providers on an ongoing basis.

Assessment Methods

Examine

• System and services acquisition policy
• system and services acquisition procedures
• procedures addressing methods and techniques for monitoring control compliance by external service providers of system services
• acquisition documentation
• contracts
• service level agreements
• interagency agreements
• licensing agreements
• list of organizational security and privacy requirements for external provider services
• control assessment results or reports from external providers of system services
• system security plan
• privacy plan
• supply chain risk management plan
• other relevant documents or records

Interview

• Organizational personnel with acquisition responsibilities
• external providers of system services
• organizational personnel with information security and privacy responsibilities
• organizational personnel with supply chain risk management responsibilities

Test

• Organizational processes for monitoring security and privacy control compliance by external service providers on an ongoing basis
• mechanisms for monitoring security and privacy control compliance by external service providers on an ongoing basis

Assessment Objective

Determine if:

• SA-11a.
  • SA-11a.[01] the developer of the system, system component, or system service is required at all post-design stages of the system development life cycle to develop a plan for ongoing security assessments;
  • SA-11a.[02] the developer of the system, system component, or system service is required at all post-design stages of the system development life cycle to implement a plan for ongoing security assessments;
  • SA-11a.[03] the developer of the system, system component, or system service is required at all post-design stages of the system development life cycle to develop a plan for privacy assessments;
  • SA-11a.[04] the developer of the system, system component, or system service is required at all post-design stages of the system development life cycle to implement a plan for ongoing privacy assessments;
• SA-11b. the developer of the system, system component, or system service is required at all post-design stages of the system development life cycle to perform [Selection (one or more): unit; integration; system; regression] testing/evaluation [Assignment: frequency to conduct] at [Assignment: depth and coverage];
• SA-11c.
  • SA-11c.[01] the developer of the system, system component, or system service is required at all post-design stages of the system development life cycle to produce evidence of the execution of the assessment plan;
  • SA-11c.[02] the developer of the system, system component, or system service is required at all post-design stages of the system development life cycle to produce the results of the testing and evaluation;
• SA-11d. the developer of the system, system component, or system service is required at all post-design stages of the system development life cycle to implement a verifiable flaw remediation process;
• SA-11e. the developer of the system, system component, or system service is required at all post-design stages of the system development life cycle to correct flaws identified during testing and evaluation.

Assessment Methods

Examine

• System and services acquisition policy
• system and services acquisition procedures
• procedures addressing system developer security and privacy testing
• procedures addressing flaw remediation
• solicitation documentation
• acquisition documentation
• service level agreements
• acquisition contracts for the system, system component, or system service
• security and privacy architecture
• system design documentation
• system developer security and privacy assessment plans
• results of developer security and privacy assessments for the system, system component, or system service
• security and privacy flaw and remediation tracking records
• system security plan
• privacy plan
• privacy impact assessment
• privacy risk assessment documentation
• other relevant documents or records

Interview

• Organizational personnel with system and service acquisition responsibilities
• organizational personnel with information security and privacy responsibilities
• organizational personnel with developer security and privacy testing responsibilities
• system developers

Test

• Organizational processes for monitoring developer security testing and evaluation
• mechanisms supporting and/or implementing the monitoring of developer security and privacy testing and evaluation

Assessment Objective

Determine if:

• SC-07(24)(a) [Assignment: processing rules] are applied to data elements of personally identifiable information on systems that process personally identifiable information;
• SC-07(24)(b)
  • SC-07(24)(b)[01] permitted processing is monitored at the external interfaces to the systems that process personally identifiable information;
  • SC-07(24)(b)[02] permitted processing is monitored at key internal boundaries within the systems that process personally identifiable information;
• SC-07(24)(c) each processing exception is documented for systems that process personally identifiable information;
• SC-07(24)(d)
  • SC-07(24)(d)[01] exceptions for systems that process personally identifiable information are reviewed;
  • SC-07(24)(d)[02] exceptions for systems that process personally identifiable information that are no longer supported are removed.

Assessment Methods

Examine

• System and communications protection policy
• procedures addressing boundary protection
• personally identifiable information processing policies
• list of key internal boundaries of the system
• system design documentation
• system configuration settings and associated documentation
• enterprise security and privacy architecture documentation
• system audit records
• system security plan
• privacy plan
• personally identifiable information inventory documentation
• data mapping documentation
• other relevant documents or records

Interview

• System/network administrators
• organizational personnel with information security and privacy responsibilities
• system developer
• organizational personnel with boundary protection responsibilities

Test

• Mechanisms implementing boundary protection capabilities

Assessment Objective

Determine if:

• SI-01a.
  • SI-01a.[01] a system and information integrity policy is developed and documented;
  • SI-01a.[02] the system and information integrity policy is disseminated to [Assignment: personnel or roles];
  • SI-01a.[03] system and information integrity procedures to facilitate the implementation of the system and information integrity policy and associated system and information integrity controls are developed and documented;
  • SI-01a.[04] the system and information integrity procedures are disseminated to [Assignment: personnel or roles];
  • SI-01a.01
    • SI-01a.01(a)
      • SI-01a.01(a)[01] the [Selection (one or more): organization-level; mission/business process-level; system-level] system and information integrity policy addresses purpose;
      • SI-01a.01(a)[02] the [Selection (one or more): organization-level; mission/business process-level; system-level] system and information integrity policy addresses scope;
      • SI-01a.01(a)[03] the [Selection (one or more): organization-level; mission/business process-level; system-level] system and information integrity policy addresses roles;
      • SI-01a.01(a)[04] the [Selection (one or more): organization-level; mission/business process-level; system-level] system and information integrity policy addresses responsibilities;
      • SI-01a.01(a)[05] the [Selection (one or more): organization-level; mission/business process-level; system-level] system and information integrity policy addresses management commitment;
      • SI-01a.01(a)[06] the [Selection (one or more): organization-level; mission/business process-level; system-level] system and information integrity policy addresses coordination among organizational entities;
      • SI-01a.01(a)[07] the [Selection (one or more): organization-level; mission/business process-level; system-level] system and information integrity policy addresses compliance;
    • SI-01a.01(b) the [Selection (one or more): organization-level; mission/business process-level; system-level] system and information integrity policy is consistent with applicable laws, Executive Orders, directives, regulations, policies, standards, and guidelines;
• SI-01b. the [Assignment: official] is designated to manage the development, documentation, and dissemination of the system and information integrity policy and procedures;
• SI-01c.
  • SI-01c.01
    • SI-01c.01[01] the current system and information integrity policy is reviewed and updated [Assignment: frequency];
    • SI-01c.01[02] the current system and information integrity policy is reviewed and updated following [Assignment: events];
  • SI-01c.02
    • SI-01c.02[01] the current system and information integrity procedures are reviewed and updated [Assignment: frequency];
    • SI-01c.02[02] the current system and information integrity procedures are reviewed and updated following [Assignment: events].

Assessment Methods

Examine

• System and information integrity policy
• system and information integrity procedures
• system security plan
• privacy plan
• other relevant documents or records

Interview

• Organizational personnel with system and information integrity responsibilities
• organizational personnel with information security and privacy responsibilities

Assessment Objective

Determine if:

• SI-12[01] information within the system is managed in accordance with applicable laws, Executive Orders, directives, regulations, policies, standards, guidelines, and operational requirements;
• SI-12[02] information within the system is retained in accordance with applicable laws, Executive Orders, directives, regulations, policies, standards, guidelines, and operational requirements;
• SI-12[03] information output from the system is managed in accordance with applicable laws, Executive Orders, directives, regulations, policies, standards, guidelines, and operational requirements;
• SI-12[04] information output from the system is retained in accordance with applicable laws, Executive Orders, directives, regulations, policies, standards, guidelines, and operational requirements.

Assessment Methods

Examine

• System and information integrity policy
• system and information integrity procedures
• personally identifiable information processing policy
• records retention and disposition policy
• records retention and disposition procedures
• federal laws, Executive Orders, directives, policies, regulations, standards, and operational requirements applicable to information management and retention
• media protection policy
• media protection procedures
• audit findings
• system security plan
• privacy plan
• privacy program plan
• personally identifiable information inventory
• privacy impact assessment
• privacy risk assessment documentation
• other relevant documents or records

Interview

• Organizational personnel with information and records management, retention, and disposition responsibilities
• organizational personnel with information security and privacy responsibilities
• network administrators

Test

• Organizational processes for information management, retention, and disposition
• automated mechanisms supporting and/or implementing information management, retention, and disposition

Assessment Objective

Determine if:

• SI-12(01) personally identifiable information being processed in the information life cycle is limited to [Assignment: elements of personally identifiable information].

Assessment Methods

Examine

• System and information integrity policy
• system and information integrity procedures
• personally identifiable information processing policy
• personally identifiable information processing procedures
• records retention and disposition policy
• records retention and disposition procedures
• federal laws, Executive Orders, directives, policies, regulations, standards, and operational requirements applicable to limiting personally identifiable information elements
• personally identifiable information inventory
• system audit records
• audit findings
• system security plan
• privacy plan
• privacy program plan
• privacy impact assessment
• privacy risk assessment documentation
• data mapping documentation
• other relevant documents or records

Interview

• Organizational personnel with information and records management, retention, and disposition responsibilities
• organizational personnel with security and privacy responsibilities
• network administrators

Test

• Organizational processes for information management and retention (including limiting personally identifiable information processing)
• automated mechanisms supporting and/or implementing limits to personally identifiable information processing

Assessment Objective

Determine if:

• SI-12(02)[01] [Assignment: techniques] are used to minimize the use of personally identifiable information for research;
• SI-12(02)[02] [Assignment: techniques] are used to minimize the use of personally identifiable information for testing;
• SI-12(02)[03] [Assignment: techniques] are used to minimize the use of personally identifiable information for training.

Assessment Methods

Examine

• System and information integrity policy
• system and information integrity procedures
• personally identifiable information processing policy
• personally identifiable information processing procedures
• federal laws, Executive Orders, directives, policies, regulations, standards, and operational requirements applicable to minimizing the use of personally identifiable information in testing, training, and research
• policy for the minimization of personally identifiable information used in testing, training, and research
• procedures for the minimization of personally identifiable information used in testing, training, and research
• documentation supporting minimization policy implementation (e.g., templates for testing, training, and research)
• data sets used for testing, training, and research
• system security plan
• privacy plan
• privacy impact assessment
• privacy risk assessment documentation
• other relevant documents or records

Interview

• Organizational personnel with information and records management, retention, and disposition responsibilities
• organizational personnel with information security and privacy responsibilities
• network administrators
• system developers
• personnel with IRB responsibilities

Test

• Organizational processes for the minimization of personally identifiable information used in testing, training, and research
• automated mechanisms supporting and/or implementing the minimization of personally identifiable information used in testing, training, and research

Assessment Objective

Determine if:

• SI-12(03)[01] [Assignment: techniques] are used to dispose of information following the retention period;
• SI-12(03)[02] [Assignment: techniques] are used to destroy information following the retention period;
• SI-12(03)[03] [Assignment: techniques] are used to erase information following the retention period.

Assessment Methods

Examine

• System and information integrity policy
• system and information integrity procedures
• personally identifiable information processing policy
• personally identifiable information processing procedures
• records retention and disposition policy
• records retention and disposition procedures
• laws, Executive Orders, directives, policies, regulations, standards, and operational requirements applicable to information disposal
• media protection policy
• media protection procedures
• system audit records
• audit findings
• information disposal records
• system security plan
• privacy plan
• privacy impact assessment
• privacy risk assessment documentation
• other relevant documents or records

Interview

• Organizational personnel with information and records management, retention, and disposition responsibilities
• organizational personnel with information security and privacy responsibilities
• network administrators

Test

• Organizational processes for information disposition
• automated mechanisms supporting and/or implementing information disposition

Assessment Objective

Determine if:

• SI-18a.
  • SI-18a.[01] the accuracy of personally identifiable information across the information life cycle is checked [Assignment: frequency];
  • SI-18a.[02] the relevance of personally identifiable information across the information life cycle is checked [Assignment: frequency];
  • SI-18a.[03] the timeliness of personally identifiable information across the information life cycle is checked [Assignment: frequency];
  • SI-18a.[04] the completeness of personally identifiable information across the information life cycle is checked [Assignment: frequency];
• SI-18b. inaccurate or outdated personally identifiable information is corrected or deleted.

Assessment Methods

Examine

• System and information integrity policy
• system and information integrity procedures
• personally identifiable information processing policy
• documentation addressing personally identifiable information quality operations
• quality reports
• maintenance logs
• system audit records
• audit findings
• system security plan
• privacy plan
• privacy impact assessment
• privacy risk assessment documentation
• other relevant documents or records

Interview

• Organizational personnel responsible for performing personally identifiable information quality inspections
• organizational personnel with information security responsibilities
• organizational personnel with privacy responsibilities

Test

• Organizational processes for personally identifiable information quality inspection
• automated mechanisms supporting and/or implementing personally identifiable information quality operations

Assessment Objective

Determine if:

• SI-18(04) personally identifiable information is corrected or deleted upon request by individuals or their designated representatives.

Assessment Methods

Examine

• System and information integrity policy
• system and information integrity procedures
• personally identifiable information processing policy
• system configuration
• individual requests
• records of correction or deletion actions performed
• system audit records
• system security plan
• privacy plan
• privacy impact assessment
• privacy risk assessment documentation
• other relevant documents or records

Interview

• Organizational personnel responsible for responding to individual requests for personally identifiable information correction or deletion
• organizational personnel with information security and privacy responsibilities

Test

• Request mechanisms
• automated mechanisms supporting and/or implementing individual requests for correction or deletion

Assessment Objective

Determine if:

• SI-19a. [Assignment: elements] are removed from datasets;
• SI-19b. the effectiveness of de-identification is evaluated [Assignment: frequency].

Assessment Methods

Examine

• System and information integrity policy
• system and information integrity procedures
• personally identifiable information processing policy
• de-identification procedures
• system configuration
• datasets with personally identifiable information removed
• system security plan
• privacy plan
• privacy impact assessment
• privacy risk assessment documentation
• other relevant documents or records

Interview

• Organizational personnel responsible for identifying unnecessary identifiers
• organizational personnel responsible for removing personally identifiable information from datasets
• organizational personnel with information security and privacy responsibilities

Test

• Automated mechanisms supporting and/or implementing the removal of personally identifiable information elements