Assessment Objective
Determine if:
- PL-08a.
- PL-08a.01 a security architecture for the system describes the requirements and approach to be taken for protecting the confidentiality, integrity, and availability of organizational information;
- PL-08a.02 a privacy architecture describes the requirements and approach to be taken for processing personally identifiable information to minimize privacy risk to individuals;
- PL-08a.03
- PL-08a.03[01] a security architecture for the system describes how the architecture is integrated into and supports the enterprise architecture;
- PL-08a.03[02] a privacy architecture for the system describes how the architecture is integrated into and supports the enterprise architecture;
- PL-08a.04
- PL-08a.04[01] a security architecture for the system describes any assumptions about and dependencies on external systems and services;
- PL-08a.04[02] a privacy architecture for the system describes any assumptions about and dependencies on external systems and services;
- PL-08b. changes in the enterprise architecture are reviewed and updated [Assignment: frequency] to reflect changes in the enterprise architecture;
- PL-08c.
- PL-08c.[01] planned architecture changes are reflected in the security plan;
- PL-08c.[02] planned architecture changes are reflected in the privacy plan;
- PL-08c.[03] planned architecture changes are reflected in the Concept of Operations (CONOPS);
- PL-08c.[04] planned architecture changes are reflected in criticality analysis;
- PL-08c.[05] planned architecture changes are reflected in organizational procedures;
- PL-08c.[06] planned architecture changes are reflected in procurements and acquisitions.
Assessment Methods
Examine
- Security and privacy planning policy
- procedures addressing information security and privacy architecture development
- procedures addressing information security and privacy architecture reviews and updates
- enterprise architecture documentation
- information security and privacy architecture documentation
- system security plan
- privacy plan
- security and privacy CONOPS for the system
- records of information security and privacy architecture reviews and updates
- other relevant documents or records
Interview
- Organizational personnel with security and privacy planning and plan implementation responsibilities
- organizational personnel with information security and privacy architecture development responsibilities
- organizational personnel with information security and privacy responsibilities
Test
- Organizational processes for developing, reviewing, and updating the information security and privacy architecture
- mechanisms supporting and/or implementing the development, review, and update of the information security and privacy architecture
Powiązane zgłoszenia
| Typ powiązania | Zgłoszenie |
|---|---|
| blocks | PL-08 [M] Security and Privacy Architectures |