+PM-11 [P] Mission and Business Process Definition
|
PM-11 [P] Mission and Business Process Definition
Control
- Define organizational mission and business processes with consideration for information security and privacy and the resulting risk to organizational operations, organizational assets, individuals, other organizations, and the Nation; and
- Determine information protection and personally identifiable information processing needs arising from the defined mission and business processes; and
- Review and revise the mission and business processes [Assignement: frequency].
Discussion
Protection needs are technology-independent capabilities that are required to counter threats to organizations, individuals, systems, and the Nation through the compromise of information (i.e., loss of confidentiality, integrity, availability, or privacy). Information protection and personally identifiable information processing needs are derived from the mission and business needs defined by organizational stakeholders, the mission and business processes designed to meet those needs, and the organizational risk management strategy. Information protection and personally identifiable information processing needs determine the required controls for the organization and the systems. Inherent to defining protection and personally identifiable information processing needs is an understanding of the adverse impact that could result if a compromise or breach of information occurs. The categorization process is used to make such potential impact determinations. Privacy risks to individuals can arise from the compromise of personally identifiable information, but they can also arise as unintended consequences or a byproduct of the processing of personally identifiable information at any stage of the information life cycle. Privacy risk assessments are used to prioritize the risks that are created for individuals from system processing of personally identifiable information. These risk assessments enable the selection of the required privacy controls for the organization and systems. Mission and business process definitions and the associated protection requirements are documented in accordance with organizational policies and procedures.
Assessment Objective
- organizational mission and business processes are defined with consideration for information security;
- organizational mission and business processes are defined with consideration for privacy;
- organizational mission and business processes are defined with consideration for the resulting risk to organizational operations, organizational assets, individuals, other organizations, and the Nation;
- information protection needs arising from the defined mission and business processes are determined;
- personally identifiable information processing needs arising from the defined mission and business processes are determined;
- the mission and business processes are reviewed and revised [Assignement: frequency].
Assessment Method
Examine
Information security program plan
privacy program plan
risk management strategy
procedures for determining mission and business protection needs
information security and privacy risk assessment results relevant to the determination of mission and business protection needs
personally identifiable information processing policy
personally identifiable information inventory
other relevant documents or records
Interview
Organizational personnel with information security and privacy program planning and plan implementation responsibilities
organizational personnel responsible for enterprise risk management
organizational personnel responsible for determining information protection needs for mission and business processes
organizational personnel with information security and privacy responsibilities
1. Ħarsa ġenerali
1.1 Referenzi
1.2 Rekwiżiti identifikati
1.3 Regolamenti relatati
2. Rekwiżiti identifikati
3. Regolamenti relatati
Regolamenti
| Sors |
Regolamentazzjoni |
Kwistjonijiet marbuta
|