NIST SP 800-53Ar1 Assessment Procedure Catalog, with SP 800-53r3 Security Controls
PROGRAM MANAGEMENT
PM-1 INFORMATION SECURITY PROGRAM PLAN
| FAMILY: PROGRAM MANAGEMENT
|
CLASS: MANAGEMENT
|
| ASSESSMENT PROCEDURE
|
| PM-1 |
INFORMATION SECURITY PROGRAM PLAN
|
| PM-1.1 |
ASSESSMENT OBJECTIVE:
Determine if:
- (i) the organization develops an information security program plan for the organization that:
- provides an overview of the requirements for the security program;
- provides a description of the security program management controls and common controls in place or planned for meeting security program requirements;
- provides sufficient information about the program management controls and common controls (including specification of parameters for any assignment and selection operations either explicitly or by reference) to enable an implementation that is unambiguously compliant with the intent of the plan and a determination of the risk to be incurred if the plan is implemented as intended;
- includes roles, responsibilities, management commitment, coordination among organizational entities, and compliance;
- is approved by a senior official with responsibility and accountability for the risk being incurred to organizational operations (including mission, functions, image, and reputation), organizational assets, individuals, other organizations and the Nation;
- (ii) the organization defines the frequency of information security program plan reviews;
- (iii) the organization reviews the organization-wide information security program plan in accordance with the organization-defined frequency;
- (iv) the organization revises the plan to address organizational changes and problems identified during plan implementation or security control assessments; and
- (v) the organization disseminates the most recent information security program plan to appropriate entities in the organization.
|
- POTENTIAL ASSESSMENT METHODS AND OBJECTS:
- Examine: [SELECT FROM: Information security program policy; procedures addressing information security program plan development and implementation; procedures addressing information security program plan reviews and updates; information security program plan; program management controls documentation; common controls documentation; records of information security program plan reviews and updates; other relevant documents or records].
- Interview: [SELECT FROM: Organizational personnel with security planning and plan implementation responsibilities for the information security program].
|
PM-2 SENIOR INFORMATION SECURITY OFFICER
| FAMILY: PROGRAM MANAGEMENT
|
CLASS: MANAGEMENT
|
PM-3 INFORMATION SECURITY RESOURCES
| FAMILY: PROGRAM MANAGEMENT
|
CLASS: MANAGEMENT
|
| ASSESSMENT PROCEDURE
|
| PM-3 |
INFORMATION SECURITY RESOURCES
|
| PM-3.1 |
ASSESSMENT OBJECTIVE:
Determine if:
- (i) the organization includes in its capital planning and investment requests the resources needed to implement the information security program;
- (ii) the organization documents all exceptions to the requirement that all capital planning and investment requests include the resources needed to implement the information security program;
- (iii) the organization employs a business case/Exhibit 300/Exhibit 53 to record the resources required; and
- (iv) the organization makes the required information security resources available for expenditure as planned.
|
- POTENTIAL ASSESSMENT METHODS AND OBJECTS:
- Examine: [SELECT FROM: Information security program policy; capital planning and investment policy; procedures addressing management and oversight for information security-related aspects of the capital planning and investment control process; capital planning and investment documentation; documentation of exceptions supporting capital planning and investment requests; business cases; Exhibit 300; Exhibit 53; other relevant documents or records].
- Interview: [SELECT FROM: Organizational personnel managing and overseeing the information security-related aspects of the capital planning and investment control process].
|
PM-4 PLAN OF ACTION AND MILESTONES PROCESS
| FAMILY: PROGRAM MANAGEMENT
|
CLASS: MANAGEMENT
|
PM-5 INFORMATION SYSTEM INVENTORY
| FAMILY: PROGRAM MANAGEMENT
|
CLASS: MANAGEMENT
|
| ASSESSMENT PROCEDURE
|
| PM-5 |
INFORMATION SYSTEM INVENTORY
|
| PM-5.1 |
ASSESSMENT OBJECTIVE:
Determine if:
- (i) the organization develops an inventory of its information systems; and
- (ii) the organization maintains an inventory of its information systems.
|
- POTENTIAL ASSESSMENT METHODS AND OBJECTS:
- Examine: [SELECT FROM: Information security program policy; procedures addressing information system inventory development and maintenance; information system inventory records, other relevant documents or records].
- Interview: [SELECT FROM: Organizational personnel with information system inventory development and maintenance responsibilities].
|
PM-6 INFORMATION SECURITY MEASURES OF PERFORMANCE
| FAMILY: PROGRAM MANAGEMENT
|
CLASS: MANAGEMENT
|
| ASSESSMENT PROCEDURE
|
| PM-6 |
INFORMATION SECURITY MEASURES OF PERFORMANCE
|
| PM-6.1 |
ASSESSMENT OBJECTIVE:
Determine if:
- (i) the organization develops information security measures of performance;
- (ii) the organization monitors information security measures of performance; and
- (iii) the organization reports on the results of information security measures of performance.
|
- POTENTIAL ASSESSMENT METHODS AND OBJECTS:
- Examine: [SELECT FROM: Information security program policy; procedures addressing development, monitoring, and reporting of information security performance measures; information security performance metrics; information security performance measures; results of information security performance measures; other relevant documents or records].
|
PM-7 ENTERPRISE ARCHITECTURE
| FAMILY: PROGRAM MANAGEMENT
|
CLASS: MANAGEMENT
|
PM-8 CRITICAL INFRASTRUCTURE PLAN
| FAMILY: PROGRAM MANAGEMENT
|
CLASS: MANAGEMENT
|
| ASSESSMENT PROCEDURE
|
| PM-8 |
CRITICAL INFRASTRUCTURE PLAN
|
| PM-8.1 |
ASSESSMENT OBJECTIVE:
Determine if:
- (i) the organization develops and documents a critical infrastructure and key resource protection plan;
- (ii) the organization updates the critical infrastructure and key resource protection plan; and
- (iii) the organization addresses information security issues in the critical infrastructure and key resource protection plan.
|
- POTENTIAL ASSESSMENT METHODS AND OBJECTS:
- Examine: [SELECT FROM: Information security program policy; critical infrastructure protection policy; procedures addressing critical infrastructure plan development and implementation; procedures addressing critical infrastructure plan reviews and updates; records of critical infrastructure plan reviews and updates; other relevant documents or records].
- Interview: [SELECT FROM: Organizational personnel with critical infrastructure plan development and implementation responsibilities].
|
PM-9 RISK MANAGEMENT STRATEGY
| FAMILY: PROGRAM MANAGEMENT
|
CLASS: MANAGEMENT
|
| ASSESSMENT PROCEDURE
|
| PM-9 |
RISK MANAGEMENT STRATEGY
|
| PM-9.1 |
ASSESSMENT OBJECTIVE:
Determine if:
- (i) the organization develops a comprehensive strategy to manage risk to organizational operations and assets, individuals, other organizations, and the Nation associated with the operation and use of information systems; and
- (ii) the organization implements that strategy consistently across the organization.
|
- POTENTIAL ASSESSMENT METHODS AND OBJECTS:
- Examine: [SELECT FROM: Information security program policy; risk management policy; procedures addressing risk management strategy development and implementation; risk management strategy (including risk identification, assessment, mitigation, acceptance, and monitoring methodologies); other relevant documents or records].
- Interview: [SELECT FROM: Organizational personnel with risk management strategy development and implementation responsibilities].
|
PM-10 SECURITY AUTHORIZATION PROCESS
| FAMILY: PROGRAM MANAGEMENT
|
CLASS: MANAGEMENT
|
PM-11 MISSION / BUSINESS PROCESS DEFINITION
| FAMILY: PROGRAM MANAGEMENT
|
CLASS: MANAGEMENT
|
| ASSESSMENT PROCEDURE
|
| PM-11 |
MISSION / BUSINESS PROCESS DEFINITION
|
| PM-11.1 |
ASSESSMENT OBJECTIVE:
Determine if:
- (i) the organization defines mission/business processes with consideration for information security and the resulting risk to organizational operations, organizational assets, individuals, other organizations, and the Nation; and
- (ii) the organization determines information protection needs arising from the defined mission/business processes and revises the processes as necessary, until an achievable set of protection needs is obtained.
|
- POTENTIAL ASSESSMENT METHODS AND OBJECTS:
- Examine: [SELECT FROM: Information security program policy; risk management policy; procedures addressing security categorization of organizational information and information systems; organizational mission/business processes; risk management strategy (including risk identification, assessment, mitigation, acceptance, and monitoring methodologies); other relevant documents or records].
- Interview: [SELECT FROM: Organizational personnel with mission/business process definition responsibilities; organizational personnel with security categorization and risk management responsibilities for the information security program].
|
Source
