Assessment Objective

Determine if:

• PM-08[01] information security issues are addressed in the development of a critical infrastructure and key resources protection plan;
• PM-08[02] information security issues are addressed in the documentation of a critical infrastructure and key resources protection plan;
• PM-08[03] information security issues are addressed in the update of a critical infrastructure and key resources protection plan;
• PM-08[04] privacy issues are addressed in the development of a critical infrastructure and key resources protection plan;
• PM-08[05] privacy issues are addressed in the documentation of a critical infrastructure and key resources protection plan;
• PM-08[06] privacy issues are addressed in the update of a critical infrastructure and key resources protection plan.

Assessment Methods

Examine

• Information security program plan
• privacy program plan
• critical infrastructure and key resources protection plan
• procedures addressing the development, documentation, and updating of the critical infrastructure and key resources protection plan
• HSPD 7
• National Infrastructure Protection Plan
• other relevant documents or records

Interview

• Organizational personnel with information security and privacy program planning and plan implementation responsibilities
• organizational personnel responsible for developing, documenting, and updating the critical infrastructure and key resources protection plan
• organizational personnel with information security and privacy responsibilities

Test

• Organizational processes for developing, documenting, and updating the critical infrastructure and key resources protection plan
• mechanisms supporting the development, documentation, and updating of the critical infrastructure and key resources protection plan

Tichete legate

• NIST -

  https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final