Assessment Objectives

In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that:

• IAO-09_A01 the system boundary is described and documented in the system security plan.
  Assessment rigor: 1
  Origin: 171A_3.12.4[b]
• IAO-09_A02 the system components on which sensitive / regulated data is processed are identified and documented.
  Assessment rigor: 1
  Origin: SCF Created
• IAO-09_A03 the system components on which sensitive / regulated data is stored are identified and documented.
  Assessment rigor: 1
  Origin: SCF Created
• IAO-09_A04 changes to the system or system component location where sensitive / regulated data is processed are documented.
  Assessment rigor: 1
  Origin: SCF Created
• IAO-09_A05 changes to the system or system component location where sensitive / regulated data is stored are documented.
  Assessment rigor: 1
  Origin: SCF Created
• IAO-09_A06 a system security plan that describes specific threats to the system that are of concern to the organization is developed.
  Assessment rigor: 1
  Origin: 171A_R3_A.03.15.02.a.03
• IAO-09_A07 a system security plan that describes the safeguards in place or planned for meeting the security requirements is developed.
  Assessment rigor: 1
  Origin: 171A_R3_A.03.15.02.a.06
• IAO-09_A08 a system security plan that identifies individuals that fulfill system roles and responsibilities is developed.
  Assessment rigor: 1
  Origin: 171A_R3_A.03.15.02.a.07
• IAO-09_A09 a System Security Plan (SSP) is developed that documents the additional information necessary for the protection of sensitive / regulated data.
  Assessment rigor: 1
  Origin: SCF Created
• IAO-09_A10 the system security plan is reviewed per an organization-defined frequency.
  Defined parameters: at least every 12 months, or when there are significant incidents or significant changes to risks
  Assessment rigor: 1
  Origin: SCF Created
• IAO-09_A11 the system security plan is protected from unauthorized disclosure.
  Assessment rigor: 1
  Origin: 171A_R3_A.03.15.02.c
• IAO-09_A12 the security requirements identified and approved by the designated authority as non-applicable are identified.
  Assessment rigor: 2
  Origin: 171A_3.12.4[d]
• IAO-09_A13 the method of security requirement implementation is described and documented in the system security plan.
  Assessment rigor: 2
  Origin: 171A_3.12.4[e]
• IAO-09_A14 the relationship with or connection to other systems is described and documented in the system security plan.
  Assessment rigor: 2
  Origin: 171A_3.12.4[f]
• IAO-09_A15 the system security plan documents or references the security solution selected.
  Assessment rigor: 3
  Origin: 172A_3.11.4e[a]
• IAO-09_A16 the system security plan documents or references the rationale for the security solution.
  Assessment rigor: 3
  Origin: 172A_3.11.4e[b]
• IAO-09_A17 the system security plan documents or references the risk determination.
  Assessment rigor: 3
  Origin: 172A_3.11.4e[c]
• IAO-09_A18 individuals or groups with whom cybersecurity / data privacy-related activities affecting the system that require planning and coordination is/are assigned.
  Assessment rigor: 3
  Origin: 53A_R5_PL-02_ODP[01]
• IAO-09_A19 personnel or roles to receive distributed copies of the system cybersecurity / data privacy plans is/are assigned.
  Assessment rigor: 3
  Origin: 53A_R5_PL-02_ODP[02]
• IAO-09_A20 the frequency at which the system security plan is reviewed and updated is defined.
  Defined parameters: at least every 12 months, or when there are significant incidents or significant changes to risks
  Assessment rigor: 2
  Origin: 53A_R5_PL-02_ODP[03] 171A_3.12.4[g] 171A_R3_A.03.15.02.ODP[01]
• IAO-09_A21 the system security plan is updated per an organization-defined frequency.
  Defined parameters: at least every 12 months, or when there are significant incidents or significant changes to risks
  Assessment rigor: 2
  Origin: 171A_3.12.4[h]
• IAO-09_A22 a security plan for the system is developed that is consistent with the organization's enterprise architecture.
  Assessment rigor: 3
  Origin: 53A_R5_PL-02a.01[01]
• IAO-09_A23 a privacy plan for the system is developed that is consistent with the organization's enterprise architecture.
  Assessment rigor: 3
  Origin: 53A_R5_PL-02a.01[02]
• IAO-09_A24 a system security plan that defines the constituent system components is developed.
  Assessment rigor: 2
  Origin: 53A_R5_PL-02a.02[01] 171A_R3_A.03.15.02.a.01
• IAO-09_A25 a privacy plan for the system is developed that explicitly defines the constituent system components.
  Assessment rigor: 3
  Origin: 53A_R5_PL-02a.02[02]
• IAO-09_A26 a security plan for the system is developed that describes the operational context of the system in terms of mission and business processes.
  Assessment rigor: 3
  Origin: 53A_R5_PL-02a.03[01]
• IAO-09_A27 a privacy plan for the system is developed that describes the operational context of the system in terms of mission and business processes.
  Assessment rigor: 3
  Origin: 53A_R5_PL-02a.03[02]
• IAO-09_A28 a security plan for the system is developed that identifies the individuals that fulfill system roles and responsibilities.
  Assessment rigor: 3
  Origin: 53A_R5_PL-02a.04[01]
• IAO-09_A29 a privacy plan for the system is developed that identifies the individuals that fulfill system roles and responsibilities.
  Assessment rigor: 3
  Origin: 53A_R5_PL-02a.04[02]
• IAO-09_A30 a system security plan that identifies the information types processed, stored, and transmitted by the system is developed.
  Assessment rigor: 2
  Origin: 53A_R5_PL-02a.05[01] 171A_R3_A.03.15.02.a.02
• IAO-09_A31 a privacy plan for the system is developed that identifies the information types processed, stored and transmitted by the system.
  Assessment rigor: 3
  Origin: 53A_R5_PL-02a.05[02]
• IAO-09_A32 a security plan for the system is developed that provides the security categorization of the system, including supporting rationale.
  Assessment rigor: 3
  Origin: 53A_R5_PL-02a.06[01]
• IAO-09_A33 a privacy plan for the system is developed that provides the security categorization of the system, including supporting rationale.
  Assessment rigor: 3
  Origin: 53A_R5_PL-02a.06[02]
• IAO-09_A34 a security plan for the system is developed that describes any specific threats to the system that are of concern to the organization.
  Assessment rigor: 3
  Origin: 53A_R5_PL-02a.07[01]
• IAO-09_A35 a privacy plan for the system is developed that describes any specific threats to the system that are of concern to the organization.
  Assessment rigor: 3
  Origin: 53A_R5_PL-02a.07[02]
• IAO-09_A36 a security plan for the system is developed that provides the results of a privacy risk assessment for systems processing Personal Data (PD).
  Assessment rigor: 3
  Origin: 53A_R5_PL-02a.08[01]
• IAO-09_A37 a privacy plan for the system is developed that provides the results of a privacy risk assessment for systems processing Personal Data (PD).
  Assessment rigor: 3
  Origin: 53A_R5_PL-02a.08[02]
• IAO-09_A38 a system security plan that describes the operational environment for the system and any dependencies on or connections to other systems or system components is developed.
  Assessment rigor: 2
  Origin: 53A_R5_PL-02a.09[01] 53A_R5_PL-02a.09[02] 171A_3.12.4[c] 171A_R3_A.03.15.02.a.04
• IAO-09_A39 a system security plan that provides an overview of the security requirements for the system is developed.
  Assessment rigor: 2
  Origin: 53A_R5_PL-02a.10[01] 171A_3.12.4[a] 171A_R3_A.03.15.02.a.05
• IAO-09_A40 a privacy plan for the system is developed that provides an overview of the privacy requirements for the system.
  Assessment rigor: 3
  Origin: 53A_R5_PL-02a.10[02]
• IAO-09_A41 a security plan for the system is developed that identifies any relevant control baselines or overlays, if applicable.
  Assessment rigor: 3
  Origin: 53A_R5_PL-02a.11[01]
• IAO-09_A42 a privacy plan for the system is developed that identifies any relevant control baselines or overlays, if applicable.
  Assessment rigor: 3
  Origin: 53A_R5_PL-02a.11[02]
• IAO-09_A43 a security plan for the system is developed that describes the controls in place or planned for meeting the security requirements, including rationale for any tailoring decisions.
  Assessment rigor: 3
  Origin: 53A_R5_PL-02a.12[01]
• IAO-09_A44 a privacy plan for the system is developed that describes the controls in place or planned for meeting the privacy requirements, including rationale for any tailoring decisions.
  Assessment rigor: 3
  Origin: 53A_R5_PL-02a.12[02]
• IAO-09_A45 a security plan for the system is developed that includes risk determinations for security architecture and design decisions.
  Assessment rigor: 3
  Origin: 53A_R5_PL-02a.13[01]
• IAO-09_A46 a privacy plan for the system is developed that includes risk determinations for privacy architecture and design decisions.
  Assessment rigor: 3
  Origin: 53A_R5_PL-02a.13[02]
• IAO-09_A47 a security plan for the system is developed that includes security-related activities affecting the system that require planning and coordination with individuals or groups.
  Assessment rigor: 3
  Origin: 53A_R5_PL-02a.14[01]
• IAO-09_A48 a privacy plan for the system is developed that includes privacy-related activities affecting the system that require planning and coordination with individuals or groups.
  Assessment rigor: 3
  Origin: 53A_R5_PL-02a.14[02]
• IAO-09_A49 a security plan for the system is developed that is reviewed and approved by the authorizing official or designated representative prior to plan implementation.
  Assessment rigor: 3
  Origin: 53A_R5_PL-02a.15[01]
• IAO-09_A50 a privacy plan for the system is developed that is reviewed and approved by the authorizing official or designated representative prior to plan implementation.
  Assessment rigor: 3
  Origin: 53A_R5_PL-02a.15[02]
• IAO-09_A51 copies of the plans are distributed to personnel or roles.
  Assessment rigor: 3
  Origin: 53A_R5_PL-02b.[01]
• IAO-09_A52 subsequent changes to the plans are communicated to personnel or roles.
  Assessment rigor: 3
  Origin: 53A_R5_PL-02b.[02]
• IAO-09_A53 plans are reviewed frequently.
  Defined parameters: at least annually
  Assessment rigor: 3
  Origin: 53A_R5_PL-02c.
• IAO-09_A54 plans are updated to address changes to the system and environment of operations.
  Assessment rigor: 3
  Origin: 53A_R5_PL-02d.[01]
• IAO-09_A55 plans are updated to address problems identified during the plan implementation.
  Assessment rigor: 3
  Origin: 53A_R5_PL-02d.[02]
• IAO-09_A56 plans are updated to address problems identified during control assessments.
  Assessment rigor: 3
  Origin: 53A_R5_PL-02d.[03]
• IAO-09_A57 plans are protected from unauthorized disclosure.
  Assessment rigor: 3
  Origin: 53A_R5_PL-02e.[01]
• IAO-09_A58 plans are protected from unauthorized modification.
  Assessment rigor: 3
  Origin: 53A_R5_PL-02e.[02]
• IAO-09_A59 the system components on which CUI is stored are identified and documented.
  Assessment rigor: NIST 800-171
  Origin: 171A_R3_A.03.04.11.a[02]
• IAO-09_A60 the system components on which CUI is stored are identified and documented.
  Assessment rigor: NIST 800-171
  Origin: 171A_R3_A.03.04.11.a[03]
• IAO-09_A61 changes to the system or system component location where CUI is processed are documented.
  Assessment rigor: NIST 800-171
  Origin: 171A_R3_A.03.04.11.b[01]
• IAO-09_A62 changes to the system or system component location where CUI is stored are documented.
  Assessment rigor: NIST 800-171
  Origin: 171A_R3_A.03.04.11.b[02]
• IAO-09_A63 a system security plan that includes other relevant information necessary for the protection of CUI is developed.
  Assessment rigor: NIST 800-171
  Origin: 171A_R3_A.03.15.02.a.08
• IAO-09_A64 the system security plan is reviewed <A.03.15.02.ODP[01]: frequency>.
  Defined parameters: at least every 12 months, or when there are significant incidents or significant changes to risks
  Assessment rigor: NIST 800-171
  Origin: 171A_R3_A.03.15.02.b[01]
• IAO-09_A65 the system security plan is updated <A.03.15.02.ODP[01]: frequency>.
  Defined parameters: at least every 12 months, or when there are significant incidents or significant changes to risks
  Assessment rigor: NIST 800-171
  Origin: 171A_R3_A.03.15.02.b[02]

Gekoppelde issues

• Secure Controls Framework -

  EN: GRCA includes the Secure Controls Framework® (SCF) content, © Secure Controls Framework Council, LLC, used under the Creative Commons Attribution-NoDerivatives 4.0 International Public License. SCF control numbers, names, descriptions and mappings appear exactly as published by the SCF Council – https://securecontrolsframework.com. GRCA may group or reorder SCF content for display, which does not change SCF content; the mappings are shown as links to the frameworks they name. Learn more at https://securecontrolsframework.com.

  DE: GRCA enthält Inhalte des Secure Controls Framework® (SCF), © Secure Controls Framework Council, LLC, genutzt unter der Creative Commons Attribution-NoDerivatives 4.0 International Public License. Nummern, Namen, Beschreibungen und Zuordnungen der SCF-Controls erscheinen genau so, wie der SCF Council sie veröffentlicht – https://securecontrolsframework.com. GRCA gruppiert oder sortiert SCF-Inhalte für die Anzeige, ohne sie zu verändern; die Zuordnungen erscheinen als Verknüpfungen zu den genannten Regelwerken. Mehr unter https://securecontrolsframework.com.