Assessment Objectives
In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that:
- VPM-03_A01 the breadth of testing and evaluation of required controls is defined.
Assessment rigor: 1
Origin: 53A_R5_SA-11(07)_ODP[01] 172A_3.14.3e_ODP[1] - VPM-03_A02 the depth of testing and evaluation of required controls is defined.
Assessment rigor: 1
Origin: 53A_R5_SA-11(07)_ODP[02] - VPM-03_A03 system, applications and services are monitored for vulnerabilities per an organization-defined frequency.
Defined parameters: at least monthly
Assessment rigor: 1
Origin: SCF Created - VPM-03_A04 systems and system components are included in the scope of the specified enhanced security requirements.
Assessment rigor: 3
Origin: 172A_3.14.3e[a] - VPM-03_A05 systems and system components that are not included in systems and system components are segregated in purpose-specific networks.
Assessment rigor: 3
Origin: 172A_3.14.3e[b] - VPM-03_A06 the developer of the system, system component or system service is required to perform attack surface reviews.
Assessment rigor: 3
Origin: 53A_R5_SA-11(06) - VPM-03_A07 the developer of the system, system component, or system service is required to perform vulnerability analyses during the subsequent testing and evaluation of the system, component, or service that produces evidence that meets an organization-defined breadth.
Assessment rigor: 3
Origin: 53A_R5_SA-11(07)[01] - VPM-03_A08 the developer of the system, system component, or system service is required to verify that the scope of testing and evaluation provides complete coverage of the required controls at an organization-defined depth.
Assessment rigor: 3
Origin: 53A_R5_SA-11(07)[02] - VPM-03_A09 the system is monitored for vulnerabilities <A.03.11.02.ODP[01]: frequency>.
Defined parameters: at least monthly, or when there are significant incidents or significant changes to risks
Assessment rigor: NIST 800-171
Origin: 171A_R3_A.03.11.02.a[01]
Saincheisteanna nasctha
| Cineál naisc | Saincheist |
|---|---|
| blocks | Attack Surface Scope |
- Secure Controls Framework -
EN: GRCA includes the Secure Controls Framework® (SCF) content, © Secure Controls Framework Council, LLC, used under the Creative Commons Attribution-NoDerivatives 4.0 International Public License. SCF control numbers, names, descriptions and mappings appear exactly as published by the SCF Council – https://securecontrolsframework.com. GRCA may group or reorder SCF content for display, which does not change SCF content; the mappings are shown as links to the frameworks they name. Learn more at https://securecontrolsframework.com.
DE: GRCA enthält Inhalte des Secure Controls Framework® (SCF), © Secure Controls Framework Council, LLC, genutzt unter der Creative Commons Attribution-NoDerivatives 4.0 International Public License. Nummern, Namen, Beschreibungen und Zuordnungen der SCF-Controls erscheinen genau so, wie der SCF Council sie veröffentlicht – https://securecontrolsframework.com. GRCA gruppiert oder sortiert SCF-Inhalte für die Anzeige, ohne sie zu verändern; die Zuordnungen erscheinen als Verknüpfungen zu den genannten Regelwerken. Mehr unter https://securecontrolsframework.com.