+03.04.04 Impact Analyses

03.04.04 Impact Analyses

Statement

  • a. Analyze changes to the system to determine potential security impacts prior to change implementation.

  • b. Verify that the security requirements for the system continue to be satisfied after the system changes have been implemented.

Guidance

Organizational personnel with security responsibilities conduct impact analyses that include reviewing system security plans, policies, and procedures to understand security requirements; reviewing system design documentation and operational procedures to understand how system changes might affect the security state of the system; reviewing the impacts of system changes on supply chain partners with stakeholders; and determining how potential changes to a system create new risks and the ability to mitigate those risks. Impact analyses also include risk assessments to understand the impacts of changes and determine whether additional security requirements are needed. Changes to the system may affect the safeguards and countermeasures previously implemented. This requirement is related to [](#/cprt/framework/version/SP_800_171_3_0_0/home?element=03.04.03)03.04.03. Not all changes to the system are configuration controlled.

Assessment objective

the security requirements for the system continue to be satisfied after the system changes have been implemented.

Assessment objective

changes to the system are analyzed to determine potential security impacts prior to change implementation.

Assessment method

  • configuration management policy and procedures procedures for security impact analyses for system changes configuration management plan security impact analysis documentation system design documentation analysis tools and outputs change control records system audit records system security plan other relevant documents or records

Assessment method

  • personnel with security impact analysis responsibilities personnel with information security responsibilities members of change control board system developers system administrators

Assessment method

  • processes for security impact analyses

1. Pregled

1.1 Reference

1.2 Utvrđeni zahtjevi

1.3 Povezani propisi

2. Utvrđeni zahtjevi

Zahtjevi

3. Povezani propisi

Propisi

Povezani zadaci

Poveznice
is blocked by 03.04.04 Impact Analyses – Assessment Procedure
is blocked by Security, Compliance & Resilience Representative for Asset Lifecycle Changes
is blocked by Security Impact Analysis for Changes
is blocked by Test, Validate & Document Changes
is blocked by Control Functionality Verification