Assessment Objectives
In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that:
- CPL-20_A01 a formal process exists to intake and document access requests from host governments for unrestricted and unmonitored access to the organization's Technology Assets, Applications, Services and/or Data (TAASD) that could potentially violate other applicable statutory, regulatory and/or contractual obligations.
Assessment rigor: 1
Origin: SCF Created - CPL-20_A02 executive leadership, along with legal counsel, formally identifies risks associated with non-compliance, including at a minimum: fines and operational impacts.
Assessment rigor: 1
Origin: SCF Created - CPL-20_A03 executive leadership, along with legal counsel, formally identifies primary risks associated with compliance, including at a minimum: loss of confidentiality and/or integrity of the organization's data.
Assessment rigor: 1
Origin: SCF Created - CPL-20_A04 executive leadership, along with legal counsel, formally identifies secondary risks associated with compliance, including at a minimum: non-compliance with other laws, regulations and contractual agreements.
Assessment rigor: 1
Origin: SCF Created - CPL-20_A05 executive leadership, along with legal counsel, formally identifies tertiary risks associated with compliance, including at a minimum: human rights abuses, theft of intellectual property and espionage.
Assessment rigor: 1
Origin: SCF Created - CPL-20_A06 executive leadership, along with legal counsel, formally adopts an action plan to respond to host government requests for unrestricted and unmonitored access to the organization's Technology Assets, Applications, Services and/or Data (TAASD) that could potentially violate other applicable statutory, regulatory and/or contractual obligations.
Assessment rigor: 1
Origin: SCF Created
Pedidos ligados
| Tipo de ligação | Pedido |
|---|---|
| blocks | Government Surveillance |
- Secure Controls Framework -
EN: GRCA includes the Secure Controls Framework® (SCF) content, © Secure Controls Framework Council, LLC, used under the Creative Commons Attribution-NoDerivatives 4.0 International Public License. SCF control numbers, names, descriptions and mappings appear exactly as published by the SCF Council – https://securecontrolsframework.com. GRCA may group or reorder SCF content for display, which does not change SCF content; the mappings are shown as links to the frameworks they name. Learn more at https://securecontrolsframework.com.
DE: GRCA enthält Inhalte des Secure Controls Framework® (SCF), © Secure Controls Framework Council, LLC, genutzt unter der Creative Commons Attribution-NoDerivatives 4.0 International Public License. Nummern, Namen, Beschreibungen und Zuordnungen der SCF-Controls erscheinen genau so, wie der SCF Council sie veröffentlicht – https://securecontrolsframework.com. GRCA gruppiert oder sortiert SCF-Inhalte für die Anzeige, ohne sie zu verändern; die Zuordnungen erscheinen als Verknüpfungen zu den genannten Regelwerken. Mehr unter https://securecontrolsframework.com.