Assessment Objectives

In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that:

• IAO-04_A01 the frequency at which to assess controls in the system and its environment of operation is defined.
  Defined parameters: at least annually
  Assessment rigor: 1
  Origin: 53A_R5_CA-02_ODP[01]
• IAO-04_A02 individuals or roles to whom control assessment results are to be provided are defined.
  Assessment rigor: 1
  Origin: 53A_R5_CA-02_ODP[02]
• IAO-04_A03 an appropriate assessor or assessment team is selected for the type of assessment to be conducted.
  Assessment rigor: 1
  Origin: 53A_R5_CA-02a.
• IAO-04_A04 a control assessment plan is developed that describes the scope of the assessment, including controls and control enhancements under assessment.
  Assessment rigor: 1
  Origin: 53A_R5_CA-02b.01
• IAO-04_A05 a control assessment plan is developed that describes the scope of the assessment, including assessment procedures to be used to determine control effectiveness.
  Assessment rigor: 1
  Origin: 53A_R5_CA-02b.02
• IAO-04_A06 a control assessment plan is developed that describes the scope of the assessment, including the assessment environment.
  Assessment rigor: 1
  Origin: 53A_R5_CA-02b.03[01]
• IAO-04_A07 a control assessment plan is developed that describes the scope of the assessment, including the assessment team.
  Assessment rigor: 1
  Origin: 53A_R5_CA-02b.03[02]
• IAO-04_A08 a control assessment plan is developed that describes the scope of the assessment, including assessment roles and responsibilities.
  Assessment rigor: 1
  Origin: 53A_R5_CA-02b.03[03]
• IAO-04_A09 the control assessment plan is reviewed and approved by the authorizing official or designated representative prior to conducting the assessment.
  Assessment rigor: 1
  Origin: 53A_R5_CA-02c.
• IAO-04_A10 security critical or essential software, firmware and hardware components for which to verify correctness are defined.
  Assessment rigor: 3
  Origin: 172A_3.14.7e_ODP[1] 172A_3.14.7e_ODP[2] 172A_3.14.7e_ODP[3]
• IAO-04_A11 verification methods or techniques are defined.
  Assessment rigor: 3
  Origin: 172A_3.14.7e_ODP[4]
• IAO-04_A12 the correctness of security critical or essential software, firmware and hardware components is verified using verification methods or techniques.
  Assessment rigor: 3
  Origin: 172A_3.14.7e[a] 172A_3.14.7e[b] 172A_3.14.7e[c]
• IAO-04_A13 controls are assessed in the system and its environment of operation per an assessment frequency to determine the extent to which the controls are implemented correctly, operating as intended and producing the desired outcome with respect to meeting established security requirements.
  Defined parameters: at least annually
  Assessment rigor: 3
  Origin: 53A_R5_CA-02d.[01]
• IAO-04_A14 controls are assessed in the system and its environment of operation per an assessment frequency to determine the extent to which the controls are implemented correctly, operating as intended and producing the desired outcome with respect to meeting established privacy requirements.
  Defined parameters: at least annually
  Assessment rigor: 3
  Origin: 53A_R5_CA-02d.[02]
• IAO-04_A15 a control assessment report is produced that documents the results of the assessment.
  Assessment rigor: 3
  Origin: 53A_R5_CA-02e.
• IAO-04_A16 the results of the control assessment are provided to individuals or roles.
  Assessment rigor: 3
  Origin: 53A_R5_CA-02f.

Tichete legate

• Secure Controls Framework -

  EN: GRCA includes the Secure Controls Framework® (SCF) content, © Secure Controls Framework Council, LLC, used under the Creative Commons Attribution-NoDerivatives 4.0 International Public License. SCF control numbers, names, descriptions and mappings appear exactly as published by the SCF Council – https://securecontrolsframework.com. GRCA may group or reorder SCF content for display, which does not change SCF content; the mappings are shown as links to the frameworks they name. Learn more at https://securecontrolsframework.com.

  DE: GRCA enthält Inhalte des Secure Controls Framework® (SCF), © Secure Controls Framework Council, LLC, genutzt unter der Creative Commons Attribution-NoDerivatives 4.0 International Public License. Nummern, Namen, Beschreibungen und Zuordnungen der SCF-Controls erscheinen genau so, wie der SCF Council sie veröffentlicht – https://securecontrolsframework.com. GRCA gruppiert oder sortiert SCF-Inhalte für die Anzeige, ohne sie zu verändern; die Zuordnungen erscheinen als Verknüpfungen zu den genannten Regelwerken. Mehr unter https://securecontrolsframework.com.