Assessment Objective
Determine if:
- SA-03(02)a.
- SA-03(02)a.[01] the use of live data in pre-production environments is approved for the system, system component, or system service;
- SA-03(02)a.[02] the use of live data in pre-production environments is documented for the system, system component, or system service;
- SA-03(02)a.[03] the use of live data in pre-production environments is controlled for the system, system component, or system service;
- SA-03(02)b. pre-production environments for the system, system component, or system service are protected at the same impact or classification level as any live data in use within the pre-production environments.
Assessment Methods
Examine
- System and services acquisition policy
- system and services acquisition procedures
- procedures addressing the integration of security and privacy into the system development life cycle process
- system development life cycle documentation
- security risk assessment documentation
- privacy impact assessment
- privacy risk assessment documentation
- system security plan
- privacy plan
- data mapping documentation
- personally identifiable information processing policy
- procedures addressing the authority to test with personally identifiable information
- procedures addressing the minimization of personally identifiable information used in testing, training, and research
- other relevant documents or records
Interview
- Organizational personnel with information security and privacy responsibility
- organizational personnel with system life cycle development responsibilities
Test
- Organizational processes the use of live data in pre-production environments
- mechanisms for protecting live data in pre-production environments
Kwistjonijiet marbuta
| Tip ta’ link | Kwistjoni |
|---|---|
| blocks | SA-03(02) Use of Live or Operational Data |