Assessment Objective
Determine if:
- the security requirements for the system continue to be satisfied after the system changes have been implemented.
- changes to the system are analyzed to determine potential security impacts prior to change implementation.
Assessment Methods
Examine
- configuration management policy and procedures
- procedures for security impact analyses for system changes
- configuration management plan
- security impact analysis documentation
- system design documentation
- analysis tools and outputs
- change control records
- system audit records
- system security plan
- other relevant documents or records
Interview
- personnel with security impact analysis responsibilities
- personnel with information security responsibilities
- members of change control board
- system developers
- system administrators
Test
- processes for security impact analyses
Tichete legate
| Tip de legătură | Tichet |
|---|---|
| blocks | 03.04.04 Impact Analyses |