Assessment Objective

Determine if:

• PM-01a.
  • PM-01a.[01] an organization-wide information security program plan is developed;
  • PM-01a.[02] the information security program plan is disseminated;
  • PM-01a.01
    • PM-01a.01[01] the information security program plan provides an overview of the requirements for the security program;
    • PM-01a.01[02] the information security program plan provides a description of the security program management controls in place or planned for meeting those requirements;
    • PM-01a.01[03] the information security program plan provides a description of the common controls in place or planned for meeting those requirements;
  • PM-01a.02
    • PM-01a.02[01] the information security program plan includes the identification and assignment of roles;
    • PM-01a.02[02] the information security program plan includes the identification and assignment of responsibilities;
    • PM-01a.02[03] the information security program plan addresses management commitment;
    • PM-01a.02[04] the information security program plan addresses coordination among organizational entities;
    • PM-01a.02[05] the information security program plan addresses compliance;
  • PM-01a.03 the information security program plan reflects the coordination among the organizational entities responsible for information security;
  • PM-01a.04 the information security program plan is approved by a senior official with responsibility and accountability for the risk being incurred to organizational operations (including mission, functions, image, and reputation), organizational assets, individuals, other organizations, and the Nation;
• PM-01b.
  • PM-01b.[01] the information security program plan is reviewed and updated [Assignment: frequency];
  • PM-01b.[02] the information security program plan is reviewed and updated following [Assignment: events];
• PM-01c.
  • PM-01c.[01] the information security program plan is protected from unauthorized disclosure;
  • PM-01c.[02] the information security program plan is protected from unauthorized modification.

Assessment Methods

Examine

• Information security program plan
• procedures addressing program plan development and implementation
• procedures addressing program plan reviews and updates
• procedures addressing coordination of the program plan with relevant entities
• procedures for program plan approvals
• records of program plan reviews and updates
• other relevant documents or records

Interview

• Organizational personnel with information security program planning and plan implementation responsibilities
• organizational personnel with information security responsibilities

Test

• Organizational processes for information security program plan development, review, update, and approval
• mechanisms supporting and/or implementing the information security program plan

Saincheisteanna nasctha

• NIST -

  EN: Publications of the National Institute of Standards and Technology (NIST), U.S. Department of Commerce, https://www.nist.gov/, from their electronic versions (OSCAL; SP 800-63-4 from its HTML version, https://pages.nist.gov/800-63-4/). Works of NIST employees are not subject to copyright protection in the United States (17 U.S.C. § 105); the OSCAL content is dedicated to the public domain worldwide (CC0 1.0); outside the United States NIST grants the right to reprint its technical series publications in all formats (NIST copyright statement). Republished courtesy of the National Institute of Standards and Technology; each document names its citation. Divided into sections and converted into the GRCA format, the wording unchanged. Only the versions published by NIST are authoritative.

  DE: Veröffentlichungen des National Institute of Standards and Technology (NIST), U.S. Department of Commerce, https://www.nist.gov/, aus ihren elektronischen Fassungen (OSCAL; SP 800-63-4 aus ihrer HTML-Fassung, https://pages.nist.gov/800-63-4/). Werke von NIST-Beschäftigten sind in den USA urheberrechtlich nicht geschützt (17 U.S.C. § 105); die OSCAL-Inhalte sind weltweit gemeinfrei gestellt (CC0 1.0); außerhalb der USA räumt das NIST das Recht ein, seine Technical-Series-Publikationen in allen Formaten neu zu veröffentlichen (Copyright-Hinweis des NIST). „Republished courtesy of the National Institute of Standards and Technology“; jedes Dokument nennt seine Zitierangabe. In Abschnitte aufgeteilt und in das GRCA-Format umgewandelt, der Wortlaut unverändert. Maßgeblich sind allein die vom NIST veröffentlichten Fassungen.