Assessment Objective

Determine if:

• RA-03(04)[01] [Assignment: advanced automation capabilities] are employed to predict and identify risks to [Assignment: systems or system components];
• RA-03(04)[02] [Assignment: advanced analytics capabilities] are employed to predict and identify risks to [Assignment: systems or system components].

Assessment Methods

Examine

• Risk assessment policy
• security planning policy and procedures
• procedures addressing organizational assessments of risk
• risk assessment
• risk assessment results
• risk assessment reviews
• risk assessment updates
• risk reports
• system security plan
• other relevant documents or records

Interview

• Organizational personnel with risk assessment responsibilities
• organizational personnel with security responsibilities

Test

• Organizational processes for risk assessment
• mechanisms supporting and/or conducting, documenting, reviewing, disseminating, and updating the risk assessment

Tickets liés

• NIST -

  https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final