+CM-04 Impact Analyses
---+CM-04(01) Separate Test Environments
---+CM-04(02) Verification of Controls

CM-04 Impact Analyses

Control

Analyze changes to the system to determine potential security and privacy impacts prior to change implementation.

Discussion

Organizational personnel with security or privacy responsibilities conduct impact analyses. Individuals conducting impact analyses possess the necessary skills and technical expertise to analyze the changes to systems as well as the security or privacy ramifications. Impact analyses include reviewing security and privacy plans, policies, and procedures to understand control requirements; reviewing system design documentation and operational procedures to understand control implementation and how specific system changes might affect the controls; reviewing the impact of changes on organizational supply chain partners with stakeholders; and determining how potential changes to a system create new risks to the privacy of individuals and the ability of implemented controls to mitigate those risks. Impact analyses also include risk assessments to understand the impact of the changes and determine if additional controls are required.

Assessment Objective

  1. changes to the system are analyzed to determine potential security impacts prior to change implementation;
  2. changes to the system are analyzed to determine potential privacy impacts prior to change implementation.

Assessment Method

Examine

Configuration management policy procedures addressing security impact analyses for changes to the system procedures addressing privacy impact analyses for changes to the system configuration management plan security impact analysis documentation privacy impact analysis documentation privacy impact assessment privacy risk assessment documentation, system design documentation analysis tools and associated outputs change control records system audit records system security plan privacy plan other relevant documents or records

Interview

Organizational personnel with responsibility for conducting security impact analyses organizational personnel with responsibility for conducting privacy impact analyses organizational personnel with information security and privacy responsibilities system developer system/network administrators members of change control board or similar

1. Ħarsa ġenerali

CM-04(01) Separate Test Environments

Control

Analyze changes to the system in a separate test environment before implementation in an operational environment, looking for security and privacy impacts due to flaws, weaknesses, incompatibility, or intentional malice.

Discussion

A separate test environment requires an environment that is physically or logically separate and distinct from the operational environment. The separation is sufficient to ensure that activities in the test environment do not impact activities in the operational environment and that information in the operational environment is not inadvertently transmitted to the test environment. Separate environments can be achieved by physical or logical means. If physically separate test environments are not implemented, organizations determine the strength of mechanism required when implementing logical separation.

Assessment Objective

  1. changes to the system are analyzed in a separate test environment before implementation in an operational environment;
  2. changes to the system are analyzed for security impacts due to flaws;
  3. changes to the system are analyzed for privacy impacts due to flaws;
  4. changes to the system are analyzed for security impacts due to weaknesses;
  5. changes to the system are analyzed for privacy impacts due to weaknesses;
  6. changes to the system are analyzed for security impacts due to incompatibility;
  7. changes to the system are analyzed for privacy impacts due to incompatibility;
  8. changes to the system are analyzed for security impacts due to intentional malice;
  9. changes to the system are analyzed for privacy impacts due to intentional malice.

Assessment Method

Examine

Configuration management policy procedures addressing security impact analyses for changes to the system procedures addressing privacy impact analyses for changes to the system configuration management plan security impact analysis documentation privacy impact analysis documentation privacy impact assessment privacy risk assessment documentation analysis tools and associated outputs system design documentation system architecture and configuration documentation change control records procedures addressing the authority to test with PII system audit records documentation of separate test and operational environments system security plan privacy plan other relevant documents or records

Interview

Organizational personnel with responsibility for conducting security and privacy impact analyses organizational personnel with information security and privacy responsibilities system/network administrators members of change control board or similar
CM-04(02) Verification of Controls

Control

After system changes, verify that the impacted controls are implemented correctly, operating as intended, and producing the desired outcome with regard to meeting the security and privacy requirements for the system.

Discussion

Implementation in this context refers to installing changed code in the operational system that may have an impact on security or privacy controls.

Assessment Objective

  1. the impacted controls are implemented correctly with regard to meeting the security requirements for the system after system changes;
  2. the impacted controls are implemented correctly with regard to meeting the privacy requirements for the system after system changes;
  3. the impacted controls are operating as intended with regard to meeting the security requirements for the system after system changes;
  4. the impacted controls are operating as intended with regard to meeting the privacy requirements for the system after system changes;
  5. the impacted controls are producing the desired outcome with regard to meeting the security requirements for the system after system changes;
  6. the impacted controls are producing the desired outcome with regard to meeting the privacy requirements for the system after system changes.

Assessment Method

Examine

Configuration management policy procedures addressing security impact analyses for changes to the system procedures addressing privacy impact analyses for changes to the system privacy risk assessment documentation configuration management plan security and privacy impact analysis documentation privacy impact assessment analysis tools and associated outputs change control records control assessment results system audit records system component inventory system security plan privacy plan other relevant documents or records

Interview

Organizational personnel with responsibility for conducting security and privacy impact analyses organizational personnel with information security and privacy responsibilities system/network administrators security and privacy assessors

1.1 Referenzi

1.2 Rekwiżiti identifikati

1.3 Regolamenti relatati

2. Rekwiżiti identifikati

Rekwiżiti

3. Regolamenti relatati

Regolamenti

Kwistjonijiet marbuta

Links
is blocked by CM-04 Impact Analyses – Assessment Procedure
is blocked by Security Impact Analysis for Changes