Assessment Objective
Determine if:
- PM-01a.
- PM-01a.[01] an organization-wide information security program plan is developed;
- PM-01a.[02] the information security program plan is disseminated;
- PM-01a.01
- PM-01a.01[01] the information security program plan provides an overview of the requirements for the security program;
- PM-01a.01[02] the information security program plan provides a description of the security program management controls in place or planned for meeting those requirements;
- PM-01a.01[03] the information security program plan provides a description of the common controls in place or planned for meeting those requirements;
- PM-01a.02
- PM-01a.02[01] the information security program plan includes the identification and assignment of roles;
- PM-01a.02[02] the information security program plan includes the identification and assignment of responsibilities;
- PM-01a.02[03] the information security program plan addresses management commitment;
- PM-01a.02[04] the information security program plan addresses coordination among organizational entities;
- PM-01a.02[05] the information security program plan addresses compliance;
- PM-01a.03 the information security program plan reflects the coordination among the organizational entities responsible for information security;
- PM-01a.04 the information security program plan is approved by a senior official with responsibility and accountability for the risk being incurred to organizational operations (including mission, functions, image, and reputation), organizational assets, individuals, other organizations, and the Nation;
- PM-01b.
- PM-01b.[01] the information security program plan is reviewed and updated [Assignment: frequency];
- PM-01b.[02] the information security program plan is reviewed and updated following [Assignment: events];
- PM-01c.
- PM-01c.[01] the information security program plan is protected from unauthorized disclosure;
- PM-01c.[02] the information security program plan is protected from unauthorized modification.
Assessment Methods
Examine
- Information security program plan
- procedures addressing program plan development and implementation
- procedures addressing program plan reviews and updates
- procedures addressing coordination of the program plan with relevant entities
- procedures for program plan approvals
- records of program plan reviews and updates
- other relevant documents or records
Interview
- Organizational personnel with information security program planning and plan implementation responsibilities
- organizational personnel with information security responsibilities
Test
- Organizational processes for information security program plan development, review, update, and approval
- mechanisms supporting and/or implementing the information security program plan
Incidencias vinculadas
| Tipo de vínculo | Incidencia |
|---|---|
| blocks | PM-01 Information Security Program Plan |