Assessment Objectives
In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that:
- NET-02_A01 system and communications protection procedures to facilitate the implementation of the system and communications protection policy and associated system and communications protection controls are developed and documented.
Assessment rigor: 1
Origin: 53A_R5_SC-01a.[03] - NET-02_A02 personnel or roles to whom the system and communications protection policy is to be disseminated is/are defined.
Assessment rigor: 3
Origin: 53A_R5_SC-01_ODP[01] - NET-02_A03 personnel or roles to whom the system and communications protection procedures are to be disseminated is/are defined.
Assessment rigor: 3
Origin: 53A_R5_SC-01_ODP[02] - NET-02_A04 an official to manage the system and communications protection policy and procedures is defined.
Assessment rigor: 3
Origin: 53A_R5_SC-01_ODP[03] 53A_R5_SC-01_ODP[04] - NET-02_A05 the frequency at which the current system and communications protection policy is reviewed / updated is defined.
Defined parameters: at least annually, and upon significant change
Assessment rigor: 3
Origin: 53A_R5_SC-01_ODP[05] - NET-02_A06 events that would require the current system and communications protection policy to be reviewed / updated are defined.
Defined parameters: significant changes
Assessment rigor: 3
Origin: 53A_R5_SC-01_ODP[06] - NET-02_A07 the frequency at which the current system and communications protection procedures are reviewed / updated is defined.
Defined parameters: at least annually, and upon significant change
Assessment rigor: 3
Origin: 53A_R5_SC-01_ODP[07] - NET-02_A08 events that would require the system and communications protection procedures to be reviewed / updated are defined.
Defined parameters: significant changes
Assessment rigor: 3
Origin: 53A_R5_SC-01_ODP[08] - NET-02_A09 a system and communications protection policy is developed and documented.
Assessment rigor: 3
Origin: 53A_R5_SC-01a.[01] - NET-02_A10 the system and communications protection policy is disseminated to organization-defined personnel or roles.
Assessment rigor: 3
Origin: 53A_R5_SC-01a.[02] - NET-02_A11 the system and communications protection procedures are disseminated to organization-defined personnel or roles.
Assessment rigor: 3
Origin: 53A_R5_SC-01a.[04] - NET-02_A12 the organization's system and communications protection policy addresses purpose.
Assessment rigor: 3
Origin: 53A_R5_SC-01a.01(a)[01] - NET-02_A13 the organization's system and communications protection policy addresses scope.
Assessment rigor: 3
Origin: 53A_R5_SC-01a.01(a)[02] - NET-02_A14 the organization's system and communications protection policy addresses roles.
Assessment rigor: 3
Origin: 53A_R5_SC-01a.01(a)[03] - NET-02_A15 the organization's system and communications protection policy addresses responsibilities.
Assessment rigor: 3
Origin: 53A_R5_SC-01a.01(a)[04] - NET-02_A16 the organization's system and communications protection policy addresses management commitment.
Assessment rigor: 3
Origin: 53A_R5_SC-01a.01(a)[05] - NET-02_A17 the organization's system and communications protection policy addresses coordination among organizational entities.
Assessment rigor: 3
Origin: 53A_R5_SC-01a.01(a)[06] - NET-02_A18 the organization's system and communications protection policy addresses compliance.
Assessment rigor: 3
Origin: 53A_R5_SC-01a.01(a)[07] - NET-02_A19 the organization's system and communications protection policy is consistent with applicable laws, Executive Orders, directives, regulations, policies, standards, and guidelines.
Assessment rigor: 3
Origin: 53A_R5_SC-01a.01(b) - NET-02_A20 the organization-defined official is designated to manage the development, documentation, and dissemination of the system and communications protection policy and procedures.
Assessment rigor: 3
Origin: 53A_R5_SC-01b. - NET-02_A21 the current system and communications protection policy is reviewed / updated organization-defined frequency.
Defined parameters: at least annually, and upon significant change
Assessment rigor: 3
Origin: 53A_R5_SC-01c.01[01] - NET-02_A22 the current system and communications protection policy is reviewed / updated following organization-defined events.
Defined parameters: significant changes
Assessment rigor: 3
Origin: 53A_R5_SC-01c.01[02] - NET-02_A23 the current system and communications protection procedures are reviewed / updated organization-defined frequency.
Defined parameters: at least annually, and upon significant change
Assessment rigor: 3
Origin: 53A_R5_SC-01c.02[01] - NET-02_A24 the current system and communications protection procedures are reviewed / updated following organization-defined events.
Defined parameters: significant changes
Assessment rigor: 3
Origin: 53A_R5_SC-01c.02[02] - NET-02_A25 network security management operations are conducted according to documented policies, standards, procedures and/or other organizational directives.
Assessment rigor: 1
Origin: SCF Created - NET-02_A26 resources (e.g., people, processes, technologies, data and/or facilities) required to support network security management operations are identified and provided.
Assessment rigor: 1
Origin: SCF Created - NET-02_A27 responsibility and authority for the performance of network security management-related activities are assigned to designated personnel.
Assessment rigor: 1
Origin: SCF Created - NET-02_A28 personnel performing network security management-related activities have the skills and knowledge needed to perform their assigned duties.
Assessment rigor: 2
Origin: SCF Created
Linkitetyt tehtävät
| Linkin tyyppi | Tehtävä |
|---|---|
| blocks | Network Security Controls (NSC) |
- Secure Controls Framework -
EN: GRCA includes the Secure Controls Framework® (SCF) content, © Secure Controls Framework Council, LLC, used under the Creative Commons Attribution-NoDerivatives 4.0 International Public License. SCF control numbers, names, descriptions and mappings appear exactly as published by the SCF Council – https://securecontrolsframework.com. GRCA may group or reorder SCF content for display, which does not change SCF content; the mappings are shown as links to the frameworks they name. Learn more at https://securecontrolsframework.com.
DE: GRCA enthält Inhalte des Secure Controls Framework® (SCF), © Secure Controls Framework Council, LLC, genutzt unter der Creative Commons Attribution-NoDerivatives 4.0 International Public License. Nummern, Namen, Beschreibungen und Zuordnungen der SCF-Controls erscheinen genau so, wie der SCF Council sie veröffentlicht – https://securecontrolsframework.com. GRCA gruppiert oder sortiert SCF-Inhalte für die Anzeige, ohne sie zu verändern; die Zuordnungen erscheinen als Verknüpfungen zu den genannten Regelwerken. Mehr unter https://securecontrolsframework.com.