+CA-02(03) Leveraging Results from External Organizations

CA-02(03) Leveraging Results from External Organizations

Control

Leverage the results of control assessments performed by [Assignement: external organization(s)] on [Assignement: system] when the assessment meets [Assignement: requirements].

Discussion

Organizations may rely on control assessments of organizational systems by other (external) organizations. Using such assessments and reusing existing assessment evidence can decrease the time and resources required for assessments by limiting the independent assessment activities that organizations need to perform. The factors that organizations consider in determining whether to accept assessment results from external organizations can vary. Such factors include the organization’s past experience with the organization that conducted the assessment, the reputation of the assessment organization, the level of detail of supporting assessment evidence provided, and mandates imposed by applicable laws, executive orders, directives, regulations, policies, standards, and guidelines. Accredited testing laboratories that support the Common Criteria Program [ISO 15408-1](#6afc1b04-c9d6-4023-adbc-f8fbe33a3c73) , the NIST Cryptographic Module Validation Program (CMVP), or the NIST Cryptographic Algorithm Validation Program (CAVP) can provide independent assessment results that organizations can leverage.

Assessment Objective

the results of control assessments performed by [Assignement: external organization(s)] on [Assignement: system] are leveraged when the assessment meets [Assignement: requirements].

Assessment Method

Examine

Assessment, authorization, and monitoring policy procedures addressing control assessments control assessment requirements control assessment plan control assessment report control assessment evidence plan of action and milestones system security plan privacy plan other relevant documents or records

Interview

Organizational personnel with control assessment responsibilities organizational personnel with information security and privacy responsibilities personnel performing control assessments for the specified external organization

1. Ħarsa ġenerali

1.1 Referenzi

1.2 Rekwiżiti identifikati

1.3 Regolamenti relatati

2. Rekwiżiti identifikati

Rekwiżiti

3. Regolamenti relatati

Regolamenti

Kwistjonijiet marbuta

Links
is blocked by CA-02(03) Leveraging Results from External Organizations – Assessment Procedure
is blocked by Third-Party Assessment Reciprocity