Assessment Objective
Determine if:
- RA-02(01) an impact-level prioritization of organizational systems is conducted to obtain additional granularity on system impact levels.
Assessment Methods
Examine
- Risk assessment policy
- security and privacy planning policy and procedures
- procedures addressing security categorization of organizational information and systems
- security categorization documentation
- system security plan
- privacy plan
- other relevant documents or records
Interview
- Organizational personnel with security categorization and risk assessment responsibilities
- organizational personnel with security and privacy responsibilities
Test
- Organizational processes for security categorization
Gekoppelde issues
| Koppelingstype | Issue |
|---|---|
| blocks | RA-02(01) Impact-level Prioritization |