Assessment Objective
Determine if:
- RA-03a.
- RA-03a.01 a risk assessment is conducted to identify threats to and vulnerabilities in the system;
- RA-03a.02 a risk assessment is conducted to determine the likelihood and magnitude of harm from unauthorized access, use, disclosure, disruption, modification, or destruction of the system; the information it processes, stores, or transmits; and any related information;
- RA-03a.03 a risk assessment is conducted to determine the likelihood and impact of adverse effects on individuals arising from the processing of personally identifiable information;
- RA-03b. risk assessment results and risk management decisions from the organization and mission or business process perspectives are integrated with system-level risk assessments;
- RA-03c. risk assessment results are documented in [Selection: security and privacy plans; risk assessment report; [Assignment: document] ];
- RA-03d. risk assessment results are reviewed [Assignment: frequency];
- RA-03e. risk assessment results are disseminated to [Assignment: personnel or roles];
- RA-03f. the risk assessment is updated [Assignment: frequency] or when there are significant changes to the system, its environment of operation, or other conditions that may impact the security or privacy state of the system.
Assessment Methods
Examine
- Risk assessment policy
- risk assessment procedures
- security and privacy planning policy and procedures
- procedures addressing organizational assessments of risk
- risk assessment
- risk assessment results
- risk assessment reviews
- risk assessment updates
- system security plan
- privacy plan
- other relevant documents or records
Interview
- Organizational personnel with risk assessment responsibilities
- organizational personnel with security and privacy responsibilities
Test
- Organizational processes for risk assessment
- mechanisms supporting and/or conducting, documenting, reviewing, disseminating, and updating the risk assessment
Gekoppelde issues
| Koppelingstype | Issue |
|---|---|
| blocks | RA-03 [H] Risk Assessment |