Assessment Objective
Determine if:
- PM-11a.
- PM-11a.[01] organizational mission and business processes are defined with consideration for information security;
- PM-11a.[02] organizational mission and business processes are defined with consideration for privacy;
- PM-11a.[03] organizational mission and business processes are defined with consideration for the resulting risk to organizational operations, organizational assets, individuals, other organizations, and the Nation;
- PM-11b.
- PM-11b.[01] information protection needs arising from the defined mission and business processes are determined;
- PM-11b.[02] personally identifiable information processing needs arising from the defined mission and business processes are determined;
- PM-11c. the mission and business processes are reviewed and revised [Assignment: frequency].
Assessment Methods
Examine
- Information security program plan
- privacy program plan
- risk management strategy
- procedures for determining mission and business protection needs
- information security and privacy risk assessment results relevant to the determination of mission and business protection needs
- personally identifiable information processing policy
- personally identifiable information inventory
- other relevant documents or records
Interview
- Organizational personnel with information security and privacy program planning and plan implementation responsibilities
- organizational personnel responsible for enterprise risk management
- organizational personnel responsible for determining information protection needs for mission and business processes
- organizational personnel with information security and privacy responsibilities
Test
- Organizational processes for defining mission and business processes and their information protection needs
Povezani zadaci
| Vrsta poveznice | Zadatak |
|---|---|
| blocks | PM-11 [P] Mission and Business Process Definition |