Assessment Objective
Determine if:
- SA-02a.
- SA-02a.[01] the high-level information security requirements for the system or system service are determined in mission and business process planning;
- SA-02a.[02] the high-level privacy requirements for the system or system service are determined in mission and business process planning;
- SA-02b.
- SA-02b.[01] the resources required to protect the system or system service are determined and documented as part of the organizational capital planning and investment control process;
- SA-02b.[02] the resources required to protect the system or system service are allocated as part of the organizational capital planning and investment control process;
- SA-02c.
- SA-02c.[01] a discrete line item for information security is established in organizational programming and budgeting documentation;
- SA-02c.[02] a discrete line item for privacy is established in organizational programming and budgeting documentation.
Assessment Methods
Examine
- System and services acquisition policy
- system and services acquisition procedures
- system and services acquisition strategy and plans
- procedures addressing the allocation of resources to information security and privacy requirements
- procedures addressing capital planning and investment control
- organizational programming and budgeting documentation
- system security plan
- privacy plan
- supply chain risk management policy
- other relevant documents or records
Interview
- Organizational personnel with capital planning, investment control, organizational programming, and budgeting responsibilities
- organizational personnel with information security and privacy responsibilities
- organizational personnel with supply chain risk management responsibilities
Test
- Organizational processes for determining information security and privacy requirements
- organizational processes for capital planning, programming, and budgeting
- mechanisms supporting and/or implementing organizational capital planning, programming, and budgeting
Länkade ärenden
| Länktyp | Ärende |
|---|---|
| blocks | SA-02 [P] Allocation of Resources |