Assessment Objective
Determine if:
- PM-09a.
- PM-09a.01 a comprehensive strategy is developed to manage security risk to organizational operations and assets, individuals, other organizations, and the Nation associated with the operation and use of organizational systems;
- PM-09a.02 a comprehensive strategy is developed to manage privacy risk to individuals resulting from the authorized processing of personally identifiable information;
- PM-09b. the risk management strategy is implemented consistently across the organization;
- PM-09c. the risk management strategy is reviewed and updated [Assignment: frequency] or as required to address organizational changes.
Assessment Methods
Examine
- Information security program plan
- privacy program plan
- risk management strategy
- supply chain risk management strategy
- procedures addressing the development, implementation, review, and update of the risk management strategy
- risk assessment results relevant to the risk management strategy
- other relevant documents or records
Interview
- Organizational personnel with information security and privacy program planning and plan implementation responsibilities
- organizational personnel responsible for the development, implementation, review, and update of the risk management strategy
- organizational personnel with information security and privacy responsibilities
Test
- Organizational processes for the development, implementation, review, and update of the risk management strategy
- mechanisms supporting the development, implementation, review, and update of the risk management strategy
Kwistjonijiet marbuta
| Tip ta’ link | Kwistjoni |
|---|---|
| blocks | PM-09 Risk Management Strategy |