Assessment Objectives

In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that:

• RSK-02_A01 a comprehensive strategy is developed to manage cybersecurity / data privacy risk to organizational operations and assets, individuals and other organizations associated with the operation and use of organizational systems.
  Assessment rigor: 1
  Origin: 53A_R5_PM-09a.01 53A_R5_PM-09a.02
• RSK-02_A02 the risk management strategy is implemented consistently across the organization.
  Assessment rigor: 1
  Origin: 53A_R5_PM-09b.
• RSK-02_A03 a senior organizational position for Risk Management aligns cybersecurity / data privacy management processes with strategic, operational and budgetary planning processes.
  Assessment rigor: 1
  Origin: 53A_R5_PM-29a.[02]
• RSK-02_A04 for existing facilities, physical and environmental hazards are considered in the organizational risk management strategy.
  Assessment rigor: 1
  Origin: 53A_R5_PE-23b.
• RSK-02_A05 the frequency at which to review / update the risk management strategy is defined.
  Defined parameters: at least annually
  Assessment rigor: 3
  Origin: 53A_R5_PM-09_ODP
• RSK-02_A06 the risk management strategy is reviewed / updated per an organization-defined frequency or as required to address organizational changes.
  Defined parameters: at least annually
  Assessment rigor: 3
  Origin: 53A_R5_PM-09c.
• RSK-02_A07 a senior organizational position for Risk Management is appointed.
  Assessment rigor: 3
  Origin: 53A_R5_PM-29a.[01]
• RSK-02_A08 a risk executive function is established.
  Assessment rigor: 3
  Origin: 53A_R5_PM-29b.[01]
• RSK-02_A09 a risk executive function views and analyzes risk from an organization-wide perspective.
  Assessment rigor: 3
  Origin: 53A_R5_PM-29b.[02]
• RSK-02_A10 a risk executive function ensures that the management of risk is consistent across the organization.
  Assessment rigor: 3
  Origin: 53A_R5_PM-29b.[03]
• RSK-02_A11 organization-defined security requirements are enforced to protect against supply chain risks to the system, system components, or system services and to limit the harm or consequences of supply chain-related events.
  Assessment rigor: 3
  Origin: SCF Created
• RSK-02_A12 the following security requirements are enforced to protect against supply chain risks to the system, system components, or system services and to limit the harm or consequences of supply chain-related events: <A.03.17.03.ODP[01]: security requirements>.
  Defined parameters: at a minimum, integrate Supply Chain Risk Management (SCRM) into acquisition/procurement policies, provide adequate SCRM resources, define the SCRM control baseline, establish processes to ensure suppliers disclose significant vulnerabilities and significant incidents
  Assessment rigor: NIST 800-171
  Origin: 171A_R3_A.03.17.03.b
• RSK-02_A13 risk management operations are conducted according to documented policies, standards, procedures and/or other organizational directives.
  Assessment rigor: 1
  Origin: SCF Created
• RSK-02_A14 adequate resources (e.g., people, processes, technologies, data and/or facilities) are provided to support risk management operations.
  Assessment rigor: 1
  Origin: SCF Created
• RSK-02_A15 responsibility and authority for the performance of risk management-related activities are assigned to designated personnel.
  Assessment rigor: 1
  Origin: SCF Created
• RSK-02_A16 personnel performing risk management-related activities have the skills and knowledge needed to perform their assigned duties.
  Assessment rigor: 2
  Origin: SCF Created

Prepojené úlohy

• Secure Controls Framework -

  EN: GRCA includes the Secure Controls Framework® (SCF) content, © Secure Controls Framework Council, LLC, used under the Creative Commons Attribution-NoDerivatives 4.0 International Public License. SCF control numbers, names, descriptions and mappings appear exactly as published by the SCF Council – https://securecontrolsframework.com. GRCA may group or reorder SCF content for display, which does not change SCF content; the mappings are shown as links to the frameworks they name. Learn more at https://securecontrolsframework.com.

  DE: GRCA enthält Inhalte des Secure Controls Framework® (SCF), © Secure Controls Framework Council, LLC, genutzt unter der Creative Commons Attribution-NoDerivatives 4.0 International Public License. Nummern, Namen, Beschreibungen und Zuordnungen der SCF-Controls erscheinen genau so, wie der SCF Council sie veröffentlicht – https://securecontrolsframework.com. GRCA gruppiert oder sortiert SCF-Inhalte für die Anzeige, ohne sie zu verändern; die Zuordnungen erscheinen als Verknüpfungen zu den genannten Regelwerken. Mehr unter https://securecontrolsframework.com.