Assessment Objectives

In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that:

• CPL-29_A01 Control Assurance Automation (CAA) engineering pipelines, tooling and automated collection are identified and documented as technology functions within the scope of the organization's governance.
  Assessment rigor: 1
  Origin: SCF Created
• CPL-29_A02 Control Assurance Automation (CAA) engineering pipelines, tooling and automated collection are included in the organization's risk assessment and risk register activities in the same manner as other technology functions.
  Assessment rigor: 1
  Origin: SCF Created
• CPL-29_A03 Control Assurance Automation (CAA) engineering pipelines, tooling and automated collection are subject to the same governance requirements applied to other technology functions, including ownership, access management, change management and monitoring.
  Assessment rigor: 2
  Origin: SCF Created
• CPL-29_A04 responsibility and authority for the governance and risk oversight of Control Assurance Automation (CAA) are assigned to designated personnel.
  Assessment rigor: 1
  Origin: SCF Created
• CPL-29_A05 governance and risk oversight of Control Assurance Automation (CAA) is reviewed at a defined frequency.
  Defined parameters: at least annually
  Assessment rigor: 1
  Origin: SCF Created

Prepojené úlohy

• Secure Controls Framework -

  EN: GRCA includes the Secure Controls Framework® (SCF) content, © Secure Controls Framework Council, LLC, used under the Creative Commons Attribution-NoDerivatives 4.0 International Public License. SCF control numbers, names, descriptions and mappings appear exactly as published by the SCF Council – https://securecontrolsframework.com. GRCA may group or reorder SCF content for display, which does not change SCF content; the mappings are shown as links to the frameworks they name. Learn more at https://securecontrolsframework.com.

  DE: GRCA enthält Inhalte des Secure Controls Framework® (SCF), © Secure Controls Framework Council, LLC, genutzt unter der Creative Commons Attribution-NoDerivatives 4.0 International Public License. Nummern, Namen, Beschreibungen und Zuordnungen der SCF-Controls erscheinen genau so, wie der SCF Council sie veröffentlicht – https://securecontrolsframework.com. GRCA gruppiert oder sortiert SCF-Inhalte für die Anzeige, ohne sie zu verändern; die Zuordnungen erscheinen als Verknüpfungen zu den genannten Regelwerken. Mehr unter https://securecontrolsframework.com.