Assessment Objectives

In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that:

• PRM-08.1_A01 formal checkpoints between project management stages (e.g., initiation, planning, design, build, test, deployment) are defined in the project management methodology.
  Assessment rigor: 1
  Origin: SCF Created
• PRM-08.1_A02 the security, compliance and resilience criteria that must be satisfied at each checkpoint are defined, including the earliest stage at which security, compliance and resilience requirements are identified.
  Assessment rigor: 1
  Origin: SCF Created
• PRM-08.1_A03 in-scope projects are evaluated against the defined security, compliance and resilience criteria at each checkpoint before proceeding to the next stage.
  Assessment rigor: 1
  Origin: SCF Created
• PRM-08.1_A04 checkpoint decisions, including the approver, date and any conditions or accepted risks, are recorded for each in-scope project.
  Assessment rigor: 2
  Origin: SCF Created
• PRM-08.1_A05 projects that do not satisfy a checkpoint's security, compliance and resilience criteria do not proceed to the next stage without a documented and approved exception.
  Assessment rigor: 2
  Origin: SCF Created

Susietos užduotys

• Secure Controls Framework -

  EN: GRCA includes the Secure Controls Framework® (SCF) content, © Secure Controls Framework Council, LLC, used under the Creative Commons Attribution-NoDerivatives 4.0 International Public License. SCF control numbers, names, descriptions and mappings appear exactly as published by the SCF Council – https://securecontrolsframework.com. GRCA may group or reorder SCF content for display, which does not change SCF content; the mappings are shown as links to the frameworks they name. Learn more at https://securecontrolsframework.com.

  DE: GRCA enthält Inhalte des Secure Controls Framework® (SCF), © Secure Controls Framework Council, LLC, genutzt unter der Creative Commons Attribution-NoDerivatives 4.0 International Public License. Nummern, Namen, Beschreibungen und Zuordnungen der SCF-Controls erscheinen genau so, wie der SCF Council sie veröffentlicht – https://securecontrolsframework.com. GRCA gruppiert oder sortiert SCF-Inhalte für die Anzeige, ohne sie zu verändern; die Zuordnungen erscheinen als Verknüpfungen zu den genannten Regelwerken. Mehr unter https://securecontrolsframework.com.