Assessment Objectives

In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that:

• HRS-05_A01 conditions that require the rescreening of individuals are defined.
  Defined parameters: as required by specific information / access
  Assessment rigor: 1
  Origin: 53A_R5_PS-03_ODP[01]
• HRS-05_A02 the frequency of rescreening individuals where it is so indicated is defined.
  Defined parameters: at least every three years
  Assessment rigor: 1
  Origin: 53A_R5_PS-03_ODP[02]
• HRS-05_A03 individuals are screened prior to authorizing access to the system.
  Assessment rigor: 1
  Origin: 53A_R5_PS-03a. 171A_R3_A.03.09.01.a
• HRS-05_A04 individuals are rescreened in accordance with organization-defined conditions.
  Assessment rigor: 1
  Origin: 53A_R5_PS-03b.[01]
• HRS-05_A05 individuals are screened prior to authorizing access to organizational systems.
  Assessment rigor: 2
  Origin: 171A_3.9.1
• HRS-05_A06 where rescreening is so indicated, individuals are rescreened per organization-defined frequency.
  Defined parameters: at least every three years
  Assessment rigor: 3
  Origin: 53A_R5_PS-03b.[02]
• HRS-05_A07 conditions that require the rescreening of individuals are defined.
  Defined parameters: for sensitive and/or regulated data, reinvestigation during the fifth (5th) year for top secret, the tenth (10th) year for secret and the fifteenth (15th) year for confidential
  Assessment rigor: 2
  Origin: 171A_R3_A.03.09.01.ODP[01]
• HRS-05_A08 individuals are rescreened in accordance with the following conditions: <A.03.09.01.ODP[01]: conditions>.
  Defined parameters: an organizational policy requiring rescreening when there is a significant incident, or change in status, related to an individual
  Assessment rigor: NIST 800-171
  Origin: 171A_R3_A.03.09.01.b
• HRS-05_A09 upon individual reassignment or transfer to other positions in the organization, the ongoing operational need for current logical and physical access authorizations to the system and facility is reviewed.
  Assessment rigor: 2
  Origin: 171A_R3_A.03.09.02.b.01[01]

Pedidos ligados

• Secure Controls Framework -

  EN: GRCA includes the Secure Controls Framework® (SCF) content, © Secure Controls Framework Council, LLC, used under the Creative Commons Attribution-NoDerivatives 4.0 International Public License. SCF control numbers, names, descriptions and mappings appear exactly as published by the SCF Council – https://securecontrolsframework.com. GRCA may group or reorder SCF content for display, which does not change SCF content; the mappings are shown as links to the frameworks they name. Learn more at https://securecontrolsframework.com.

  DE: GRCA enthält Inhalte des Secure Controls Framework® (SCF), © Secure Controls Framework Council, LLC, genutzt unter der Creative Commons Attribution-NoDerivatives 4.0 International Public License. Nummern, Namen, Beschreibungen und Zuordnungen der SCF-Controls erscheinen genau so, wie der SCF Council sie veröffentlicht – https://securecontrolsframework.com. GRCA gruppiert oder sortiert SCF-Inhalte für die Anzeige, ohne sie zu verändern; die Zuordnungen erscheinen als Verknüpfungen zu den genannten Regelwerken. Mehr unter https://securecontrolsframework.com.