Assessment Objectives

In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that:

• RSK-21_A01 supply chain risks associated with organizational systems and system components are identified.
  Assessment rigor: 1
  Origin: 172A_3.11.6e[a] 53A_R5_RA-03(01)_ODP[01]
• RSK-21_A02 supply chain risks associated with organizational systems and system components are assessed.
  Assessment rigor: 1
  Origin: 172A_3.11.6e[b] 53A_R5_RA-03(01)(a)
• RSK-21_A03 supply chain risks associated with organizational systems and system components are responded to.
  Assessment rigor: 1
  Origin: 172A_3.11.6e[c]
• RSK-21_A04 supply chain risks associated with organizational systems and system components are monitored.
  Assessment rigor: 1
  Origin: 172A_3.11.6e[d]
• RSK-21_A05 the frequency at which to update the supply chain risk assessment is defined.
  Defined parameters: at least every 12 months, or when there are significant incidents or significant changes to risks
  Assessment rigor: 3
  Origin: 53A_R5_RA-03(01)_ODP[02]
• RSK-21_A06 the supply chain risk assessment is updated frequently, when there are significant changes to the relevant supply chain or when changes to the system, environments of operation or other conditions may necessitate a change in the supply chain.
  Defined parameters: at least annually
  Assessment rigor: 3
  Origin: 53A_R5_RA-03(01)(b)

Kwistjonijiet marbuta

• Secure Controls Framework -

  EN: GRCA includes the Secure Controls Framework® (SCF) content, © Secure Controls Framework Council, LLC, used under the Creative Commons Attribution-NoDerivatives 4.0 International Public License. SCF control numbers, names, descriptions and mappings appear exactly as published by the SCF Council – https://securecontrolsframework.com. GRCA may group or reorder SCF content for display, which does not change SCF content; the mappings are shown as links to the frameworks they name. Learn more at https://securecontrolsframework.com.

  DE: GRCA enthält Inhalte des Secure Controls Framework® (SCF), © Secure Controls Framework Council, LLC, genutzt unter der Creative Commons Attribution-NoDerivatives 4.0 International Public License. Nummern, Namen, Beschreibungen und Zuordnungen der SCF-Controls erscheinen genau so, wie der SCF Council sie veröffentlicht – https://securecontrolsframework.com. GRCA gruppiert oder sortiert SCF-Inhalte für die Anzeige, ohne sie zu verändern; die Zuordnungen erscheinen als Verknüpfungen zu den genannten Regelwerken. Mehr unter https://securecontrolsframework.com.