Assessment Objective
Determine if:
- CM-04(01)[01] changes to the system are analyzed in a separate test environment before implementation in an operational environment;
- CM-04(01)[02] changes to the system are analyzed for security impacts due to flaws;
- CM-04(01)[03] changes to the system are analyzed for privacy impacts due to flaws;
- CM-04(01)[04] changes to the system are analyzed for security impacts due to weaknesses;
- CM-04(01)[05] changes to the system are analyzed for privacy impacts due to weaknesses;
- CM-04(01)[06] changes to the system are analyzed for security impacts due to incompatibility;
- CM-04(01)[07] changes to the system are analyzed for privacy impacts due to incompatibility;
- CM-04(01)[08] changes to the system are analyzed for security impacts due to intentional malice;
- CM-04(01)[09] changes to the system are analyzed for privacy impacts due to intentional malice.
Assessment Methods
Examine
- Configuration management policy
- procedures addressing security impact analyses for changes to the system
- procedures addressing privacy impact analyses for changes to the system
- configuration management plan
- security impact analysis documentation
- privacy impact analysis documentation
- privacy impact assessment
- privacy risk assessment documentation
- analysis tools and associated outputs system design documentation
- system architecture and configuration documentation
- change control records
- procedures addressing the authority to test with PII
- system audit records
- documentation of separate test and operational environments
- system security plan
- privacy plan
- other relevant documents or records
Interview
- Organizational personnel with responsibility for conducting security and privacy impact analyses
- organizational personnel with information security and privacy responsibilities
- system/network administrators
- members of change control board or similar
Test
- Organizational processes for security and privacy impact analyses
- mechanisms supporting and/or implementing security and privacy impact analyses of changes
Incidencias vinculadas
| Tipo de vínculo | Incidencia |
|---|---|
| blocks | CM-04(01) [H] Separate Test Environments |