Assessment Objectives

In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that:

• CPL-30_A01 chain of custody for logs, telemetry and evidence collected by Control Assurance Automation (CAA) is documented from source to repository, including the collecting mechanism, the source and the time of collection.
  Assessment rigor: 1
  Origin: SCF Created
• CPL-30_A02 the integrity of logs, telemetry and evidence collected by Control Assurance Automation (CAA) is verified upon transfer from source to repository (e.g., hash comparison, record counts or digital signatures) and transfer failures or mismatches are recorded and investigated.
  Assessment rigor: 2
  Origin: SCF Created
• CPL-30_A03 logs, telemetry and evidence collected by Control Assurance Automation (CAA) are stored in tamper-evident storage (e.g., cryptographic hashing, append-only or immutable storage) that allows unauthorized modification or deletion to be detected.
  Assessment rigor: 1
  Origin: SCF Created
• CPL-30_A04 access to the Control Assurance Automation (CAA) evidence repository is restricted to authorized personnel and access and modification attempts are logged.
  Assessment rigor: 1
  Origin: SCF Created
• CPL-30_A05 integrity verification records for Control Assurance Automation (CAA) evidence are retained for as long as the evidence itself is retained.
  Assessment rigor: 3
  Origin: SCF Created

Saincheisteanna nasctha

• Secure Controls Framework -

  EN: GRCA includes the Secure Controls Framework® (SCF) content, © Secure Controls Framework Council, LLC, used under the Creative Commons Attribution-NoDerivatives 4.0 International Public License. SCF control numbers, names, descriptions and mappings appear exactly as published by the SCF Council – https://securecontrolsframework.com. GRCA may group or reorder SCF content for display, which does not change SCF content; the mappings are shown as links to the frameworks they name. Learn more at https://securecontrolsframework.com.

  DE: GRCA enthält Inhalte des Secure Controls Framework® (SCF), © Secure Controls Framework Council, LLC, genutzt unter der Creative Commons Attribution-NoDerivatives 4.0 International Public License. Nummern, Namen, Beschreibungen und Zuordnungen der SCF-Controls erscheinen genau so, wie der SCF Council sie veröffentlicht – https://securecontrolsframework.com. GRCA gruppiert oder sortiert SCF-Inhalte für die Anzeige, ohne sie zu verändern; die Zuordnungen erscheinen als Verknüpfungen zu den genannten Regelwerken. Mehr unter https://securecontrolsframework.com.