Assessment Objective
Determine if:
- CM-08(09)(a) system components are assigned to a system;
- CM-08(09)(b) an acknowledgement of the component assignment is received from [Assignment: personnel or roles].
Assessment Methods
Examine
- Configuration management policy
- procedures addressing system component inventory
- configuration management plan
- system security plan
- system design documentation
- system component inventory
- change control records
- acknowledgements of system component assignments
- system security plan
- other relevant documents or records
Interview
- Organizational personnel with component inventory management responsibilities
- system owner
- organizational personnel with information security responsibilities
- system/network administrators
Test
- Organizational processes for assigning components to systems
- organizational processes for acknowledging assignment of components to systems
- mechanisms implementing assignment of components to the system
- mechanisms implementing acknowledgment of assignment of components to the system
Saincheisteanna nasctha
| Cineál naisc | Saincheist |
|---|---|
| blocks | CM-08(09) Assignment of Components to Systems |