Assessment Objective

Determine if:

• PM-07[01] an enterprise architecture is developed with consideration for information security;
• PM-07[02] an enterprise architecture is maintained with consideration for information security;
• PM-07[03] an enterprise architecture is developed with consideration for privacy;
• PM-07[04] an enterprise architecture is maintained with consideration for privacy;
• PM-07[05] an enterprise architecture is developed with consideration for the resulting risk to organizational operations and assets, individuals, other organizations, and the Nation;
• PM-07[06] an enterprise architecture is maintained with consideration for the resulting risk to organizational operations and assets, individuals, other organizations, and the Nation.

Assessment Methods

Examine

• Information security program plan
• privacy program plan
• enterprise architecture documentation
• procedures addressing enterprise architecture development
• results of risk assessments of enterprise architecture
• other relevant documents or records

Interview

• Organizational personnel with information security and privacy program planning and plan implementation responsibilities
• organizational personnel responsible for developing enterprise architecture
• organizational personnel responsible for risk assessments of enterprise architecture
• organizational personnel with information security and privacy responsibilities

Test

• Organizational processes for enterprise architecture development
• mechanisms supporting the enterprise architecture and its development

Tickets liés

• NIST -

  https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final