Assessment Objectives

In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that:

• EMB-04_A01 passive network monitoring is used to identify Operational Technology (OT) and Internet of Things (IoT) devices and the results are used to update the IT Asset Management (ITAM) inventory.
  Assessment rigor: 1
  Origin: SCF Created
• EMB-04_A02 the frequency at which physical inspections of Operational Technology (OT) and Internet of Things (IoT) device locations are performed is defined.
  Defined parameters: at least annually
  Assessment rigor: 1
  Origin: SCF Created
• EMB-04_A03 physical inspections of Operational Technology (OT) and Internet of Things (IoT) device locations are performed at the defined frequency and the results are reconciled against the IT Asset Management (ITAM) inventory.
  Assessment rigor: 1
  Origin: SCF Created
• EMB-04_A04 discrepancies between the IT Asset Management (ITAM) inventory and the results of passive network monitoring or physical inspection are investigated and the inventory is corrected.
  Assessment rigor: 2
  Origin: SCF Created

Lingitud teemad

• Secure Controls Framework -

  EN: GRCA includes the Secure Controls Framework® (SCF) content, © Secure Controls Framework Council, LLC, used under the Creative Commons Attribution-NoDerivatives 4.0 International Public License. SCF control numbers, names, descriptions and mappings appear exactly as published by the SCF Council – https://securecontrolsframework.com. GRCA may group or reorder SCF content for display, which does not change SCF content; the mappings are shown as links to the frameworks they name. Learn more at https://securecontrolsframework.com.

  DE: GRCA enthält Inhalte des Secure Controls Framework® (SCF), © Secure Controls Framework Council, LLC, genutzt unter der Creative Commons Attribution-NoDerivatives 4.0 International Public License. Nummern, Namen, Beschreibungen und Zuordnungen der SCF-Controls erscheinen genau so, wie der SCF Council sie veröffentlicht – https://securecontrolsframework.com. GRCA gruppiert oder sortiert SCF-Inhalte für die Anzeige, ohne sie zu verändern; die Zuordnungen erscheinen als Verknüpfungen zu den genannten Regelwerken. Mehr unter https://securecontrolsframework.com.