Assessment Objective
Determine if:
- CM-04(02)[01] the impacted controls are implemented correctly with regard to meeting the security requirements for the system after system changes;
- CM-04(02)[02] the impacted controls are implemented correctly with regard to meeting the privacy requirements for the system after system changes;
- CM-04(02)[03] the impacted controls are operating as intended with regard to meeting the security requirements for the system after system changes;
- CM-04(02)[04] the impacted controls are operating as intended with regard to meeting the privacy requirements for the system after system changes;
- CM-04(02)[05] the impacted controls are producing the desired outcome with regard to meeting the security requirements for the system after system changes;
- CM-04(02)[06] the impacted controls are producing the desired outcome with regard to meeting the privacy requirements for the system after system changes.
Assessment Methods
Examine
- Configuration management policy
- procedures addressing security impact analyses for changes to the system
- procedures addressing privacy impact analyses for changes to the system
- privacy risk assessment documentation
- configuration management plan
- security and privacy impact analysis documentation
- privacy impact assessment
- analysis tools and associated outputs
- change control records
- control assessment results
- system audit records
- system component inventory
- system security plan
- privacy plan
- other relevant documents or records
Interview
- Organizational personnel with responsibility for conducting security and privacy impact analyses
- organizational personnel with information security and privacy responsibilities
- system/network administrators
- security and privacy assessors
Test
- Organizational processes for security and privacy impact analyses
- mechanisms supporting and/or implementing security and privacy impact analyses of changes
Saincheisteanna nasctha
| Cineál naisc | Saincheist |
|---|---|
| blocks | CM-04(02) [H] Verification of Controls |