Assessment Objectives

In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that:

• RSK-13_A01 the frequency to assess risk to organizational operations, organizational assets and individuals is defined.
  Defined parameters: at least annually
  Assessment rigor: 1
  Origin: 171A_3.11.1[a] 172A_3.11.5e_ODP[1]
• RSK-13_A02 a document in which risk assessment results are to be documented (if not documented in the cybersecurity / data privacy plans or risk assessment report) is defined.
  Defined parameters: security assessment report
  Assessment rigor: 1
  Origin: 53A_R5_RA-03_ODP[01] 53A_R5_RA-03_ODP[02]
• RSK-13_A03 a risk assessment is conducted to determine the likelihood and magnitude of harm from unauthorized access, use, disclosure, disruption, modification or destruction of the system. the information it processes, stores or transmits. and any related information.
  Assessment rigor: 1
  Origin: 53A_R5_RA-03a.02
• RSK-13_A04 personnel or roles to whom risk assessment results are to be disseminated is/are defined.
  Assessment rigor: 1
  Origin: 53A_R5_RA-03_ODP[04]
• RSK-13_A05 risk assessment results are disseminated to personnel or roles.
  Assessment rigor: 1
  Origin: 53A_R5_RA-03e.
• RSK-13_A06 the frequency to update the risk assessment is defined.
  Defined parameters: at least annually
  Assessment rigor: 3
  Origin: 53A_R5_RA-03_ODP[05]
• RSK-13_A07 the frequency to review risk assessment results is defined.
  Defined parameters: at least annually
  Assessment rigor: 3
  Origin: 53A_R5_RA-03_ODP[03]
• RSK-13_A08 a risk assessment is conducted to identify threats to and vulnerabilities in the system.
  Assessment rigor: 3
  Origin: 53A_R5_RA-03a.01
• RSK-13_A09 security solutions are identified.
  Assessment rigor: 3
  Origin: 172A_3.11.5e[a]
• RSK-13_A10 current and accumulated threat intelligence is identified.
  Assessment rigor: 3
  Origin: 172A_3.11.5e[b]
• RSK-13_A11 Anticipated risk to organizational systems and the organization based on current and accumulated threat intelligence is identified.
  Assessment rigor: 3
  Origin: 172A_3.11.5e[c]
• RSK-13_A12 the effectiveness of security solutions is assessed frequency to address anticipated risk to organizational systems and the organization based on current and accumulated threat intelligence.
  Defined parameters: at least annually
  Assessment rigor: 3
  Origin: 172A_3.11.5e[d]
• RSK-13_A13 a risk assessment is conducted to determine the likelihood and impact of adverse effects on individuals arising from the processing of Personal Data (PD).
  Assessment rigor: 3
  Origin: 53A_R5_RA-03a.03
• RSK-13_A14 risk assessment results and risk management decisions from the organization and mission or business process perspectives are integrated with system-level risk assessments.
  Assessment rigor: 3
  Origin: 53A_R5_RA-03b.
• RSK-13_A15 risk assessment results are documented per organization-defined criteria.
  Defined parameters: security assessment report
  Assessment rigor: 3
  Origin: 53A_R5_RA-03c.
• RSK-13_A16 risk assessment results are reviewed frequently.
  Defined parameters: at least annually and when a significant change occurs
  Assessment rigor: 3
  Origin: 53A_R5_RA-03d.
• RSK-13_A17 the risk assessment is updated frequently or when there are significant changes to the system, its environment of operation or other conditions that may impact the cybersecurity / data privacy state of the system.
  Defined parameters: at least annually and when a significant change occurs
  Assessment rigor: 3
  Origin: 53A_R5_RA-03f.
• RSK-13_A18 risk to organizational operations, organizational assets and individuals resulting from the operation of an organizational system that processes, stores or transmits sensitive / regulated data is assessed with the defined frequency.
  Defined parameters: at least annually
  Assessment rigor: 2
  Origin: 171A_3.11.1[b]
• RSK-13_A19 the risk (including supply chain risk) of unauthorized disclosure resulting from the processing, storage, or transmission of sensitive / regulated data is assessed.
  Defined parameters: at least annually, and upon significant change to the data processing environment
  Assessment rigor: 3
  Origin: SCF Created
• RSK-13_A20 risk assessments are updated per an organization-defined frequency.
  Defined parameters: at least every 12 months, or when there are significant incidents or significant changes to risks
  Assessment rigor: 3
  Origin: SCF Created
• RSK-13_A21 the risk (including supply chain risk) of unauthorized disclosure resulting from the processing, storage, or transmission of CUI is assessed.
  Assessment rigor: NIST 800-171
  Origin: 171A_R3_A.03.11.01.a
• RSK-13_A22 risk assessments are updated <A.03.11.01.ODP[01]: frequency>.
  Defined parameters: at least every 12 months, or when there are significant incidents or significant changes to risks
  Assessment rigor: NIST 800-171
  Origin: 171A_R3_A.03.11.01.b

Povezani zadaci

• Secure Controls Framework -

  EN: GRCA includes the Secure Controls Framework® (SCF) content, © Secure Controls Framework Council, LLC, used under the Creative Commons Attribution-NoDerivatives 4.0 International Public License. SCF control numbers, names, descriptions and mappings appear exactly as published by the SCF Council – https://securecontrolsframework.com. GRCA may group or reorder SCF content for display, which does not change SCF content; the mappings are shown as links to the frameworks they name. Learn more at https://securecontrolsframework.com.

  DE: GRCA enthält Inhalte des Secure Controls Framework® (SCF), © Secure Controls Framework Council, LLC, genutzt unter der Creative Commons Attribution-NoDerivatives 4.0 International Public License. Nummern, Namen, Beschreibungen und Zuordnungen der SCF-Controls erscheinen genau so, wie der SCF Council sie veröffentlicht – https://securecontrolsframework.com. GRCA gruppiert oder sortiert SCF-Inhalte für die Anzeige, ohne sie zu verändern; die Zuordnungen erscheinen als Verknüpfungen zu den genannten Regelwerken. Mehr unter https://securecontrolsframework.com.