Assessment Objectives
In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that:
- CFG-24_A01 changes to Control Assurance Automation (CAA) collection or scoring logic that could alter reported control status are detected (e.g., through file integrity monitoring, version control hooks or configuration drift detection).
Assessment rigor: 1
Origin: SCF Created - CFG-24_A02 detected changes to Control Assurance Automation (CAA) collection or scoring logic are reconciled against authorized change records.
Assessment rigor: 2
Origin: SCF Created - CFG-24_A03 changes to Control Assurance Automation (CAA) collection or scoring logic that lack a corresponding authorized change record generate an alert to designated personnel.
Assessment rigor: 2
Origin: SCF Created - CFG-24_A04 the personnel or roles that receive alerts of unauthorized changes to Control Assurance Automation (CAA) logic are defined.
Assessment rigor: 3
Origin: SCF Created - CFG-24_A05 alerts of unauthorized changes to Control Assurance Automation (CAA) logic are investigated and resolved within a defined time period, including determining whether reported control status was affected.
Assessment rigor: 3
Origin: SCF Created
Saistītie uzdevumi
| Saites veids | Uzdevums |
|---|---|
| blocks | Control Assurance Automation (CAA) Unauthorized Change Detection |
- Secure Controls Framework -
EN: GRCA includes the Secure Controls Framework® (SCF) content, © Secure Controls Framework Council, LLC, used under the Creative Commons Attribution-NoDerivatives 4.0 International Public License. SCF control numbers, names, descriptions and mappings appear exactly as published by the SCF Council – https://securecontrolsframework.com. GRCA may group or reorder SCF content for display, which does not change SCF content; the mappings are shown as links to the frameworks they name. Learn more at https://securecontrolsframework.com.
DE: GRCA enthält Inhalte des Secure Controls Framework® (SCF), © Secure Controls Framework Council, LLC, genutzt unter der Creative Commons Attribution-NoDerivatives 4.0 International Public License. Nummern, Namen, Beschreibungen und Zuordnungen der SCF-Controls erscheinen genau so, wie der SCF Council sie veröffentlicht – https://securecontrolsframework.com. GRCA gruppiert oder sortiert SCF-Inhalte für die Anzeige, ohne sie zu verändern; die Zuordnungen erscheinen als Verknüpfungen zu den genannten Regelwerken. Mehr unter https://securecontrolsframework.com.