Assessment Objectives

In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that:

• GOV-11_A01 roles and responsibilities exist to compel data and/or process owners to operationalize security, compliance and resilience practices for the Technology Assets, Applications, Services and/or Data (TAASD) under their control.
  Assessment rigor: 1
  Origin: SCF Created
• GOV-11_A02 Individual Contributor (IC) performance reviews cover how data and/or process owners operationalized security, compliance and resilience practices for the Technology Assets, Applications, Services and/or Data (TAASD) under their control.
  Defined parameters: at least annually
  Assessment rigor: 1
  Origin: SCF Created
• GOV-11_A03 organization-defined systems security engineering principles are applied to the development or modification of the system and system components.
  Defined parameters: at a minimum, the systems security engineering principles described in NIST SP 800-160
  Assessment rigor: 3
  Origin: SCF Created
• GOV-11_A04 <A.03.16.01.ODP[01]: systems security engineering principles> are applied to the development or modification of the system and system components.
  Defined parameters: Guidance: At a minimum, documentation that provides user and administrator guidance for the implementation and operation of controls. The level of detail required in such documentation should be based on the degree to which organizations depend on the capabilities, functions, or mechanisms to meet risk response expectations. Requirements can include mandated configuration settings that specify allowed functions, ports, protocols, and services. Acceptance criteria for systems, system components, and system services are defined in the same manner as the criteria for any organizational acquisition or procurement.
  Assessment rigor: NIST 800-171
  Origin: 171A_R3_A.03.16.01

Prepojené úlohy

• Secure Controls Framework -

  EN: GRCA includes the Secure Controls Framework® (SCF) content, © Secure Controls Framework Council, LLC, used under the Creative Commons Attribution-NoDerivatives 4.0 International Public License. SCF control numbers, names, descriptions and mappings appear exactly as published by the SCF Council – https://securecontrolsframework.com. GRCA may group or reorder SCF content for display, which does not change SCF content; the mappings are shown as links to the frameworks they name. Learn more at https://securecontrolsframework.com.

  DE: GRCA enthält Inhalte des Secure Controls Framework® (SCF), © Secure Controls Framework Council, LLC, genutzt unter der Creative Commons Attribution-NoDerivatives 4.0 International Public License. Nummern, Namen, Beschreibungen und Zuordnungen der SCF-Controls erscheinen genau so, wie der SCF Council sie veröffentlicht – https://securecontrolsframework.com. GRCA gruppiert oder sortiert SCF-Inhalte für die Anzeige, ohne sie zu verändern; die Zuordnungen erscheinen als Verknüpfungen zu den genannten Regelwerken. Mehr unter https://securecontrolsframework.com.