Assessment Objective

Determine if:

• PM-05(01)[01] an inventory of all systems, applications, and projects that process personally identifiable information is established;
• PM-05(01)[02] an inventory of all systems, applications, and projects that process personally identifiable information is maintained;
• PM-05(01)[03] an inventory of all systems, applications, and projects that process personally identifiable information is updated [Assignment: frequency].

Assessment Methods

Examine

• Procedures addressing system inventory development, maintenance, and updates
• OMB FISMA reporting guidance
• privacy program plan
• information security program plan
• personally identifiable information processing policy
• system inventory
• personally identifiable information inventory
• data mapping documentation
• other relevant documents or records

Interview

• Organizational personnel with privacy program planning and plan implementation responsibilities
• organizational personnel responsible for developing and maintaining the system inventory
• organizational personnel with information security and privacy responsibilities

Test

• Organizational processes for system inventory development, maintenance, and updates
• mechanisms supporting the system inventory

Powiązane zgłoszenia

• NIST -

  https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final