Assessment Objective
Determine if:
- SA-10(07)[01] [Assignment: security representatives] are required to be included in the [Assignment: configuration change management and control processes];
- SA-10(07)[02] [Assignment: privacy representatives] are required to be included in the [Assignment: configuration change management and control processes].
Assessment Methods
Examine
- System and services acquisition policy
- system and services acquisition procedures
- configuration management policy
- configuration management plan
- solicitation documentation requiring representatives for security and privacy
- acquisition documentation
- service level agreements
- acquisition contracts for the system, system component, or system service
- system developer configuration management plan
- change control records
- configuration management records
- system security plan
- other relevant documents or records
Interview
- Organizational personnel with system and service acquisition responsibilities
- organizational personnel with information security and privacy responsibilities
- organizational personnel with configuration management responsibilities
- system developers
Pedidos ligados
| Tipo de ligação | Pedido |
|---|---|
| blocks | SA-10(07) Security and Privacy Representatives |