+CA-07(05) Consistency Analysis
|
CA-07(05) Consistency Analysis
Control
Employ the following actions to validate that policies are established and implemented controls are operating in a consistent manner: [Assignement: organization-defined actions].
Discussion
Security and privacy controls are often added incrementally to a system. As a result, policies for selecting and implementing controls may be inconsistent, and the controls could fail to work together in a consistent or coordinated manner. At a minimum, the lack of consistency and coordination could mean that there are unacceptable security and privacy gaps in the system. At worst, it could mean that some of the controls implemented in one location or by one component are actually impeding the functionality of other controls (e.g., encrypting internal network traffic can impede monitoring). In other situations, failing to consistently monitor all implemented network protocols (e.g., a dual stack of IPv4 and IPv6) may create unintended vulnerabilities in the system that could be exploited by adversaries. It is important to validate—through testing, monitoring, and analysis—that the implemented controls are operating in a consistent, coordinated, non-interfering manner.
Assessment Objective
- [Assignement: actions] are employed to validate that policies are established;
- [Assignement: actions] are employed to validate that implemented controls are operating in a consistent manner.
Assessment Method
Examine
Assessment, authorization, and monitoring policy
organizational continuous monitoring strategy
system-level continuous monitoring strategy
procedures addressing continuous monitoring of system security controls
assessment report
plan of action and milestones
system monitoring records
security impact analyses
status reports
system security plan
other relevant documents or records
Interview
Organizational personnel with continuous monitoring responsibilities
organizational personnel with information security and privacy responsibilities
1. Panoramica
1.1 Riferimenti
1.2 Requisiti identificati
1.3 Regolamentazioni correlate
2. Requisiti identificati
Requisiti
| Fonte |
Requisito |
3. Regolamentazioni correlate
Regolamentazioni
| Fonte |
Regolamentazione |
Ticket collegati
|