Navigate

CCI-000243

CCI-000243 Definition

Disseminate to organization-defined personnel or roles procedures to facilitate the implementation of the assessment, authorization, and monitoring policy and associated assessment, authorization, and monitoring controls.

Status
Type	CheckType.policy

Master Assessment Datasheet

Implementation Guidance

Determine if: - assessment, authorization, and monitoring procedures to facilitate the implementation of the assessment, authorization, and monitoring policy and associated assessment, authorization, and monitoring controls are developed and documented. - the assessment, authorization, and monitoring procedures are disseminated to [CA-01_ODP[02]; personnel or roles to whom the assessment, authorization, and monitoring procedures are to be disseminated is/are defined].

Validation Procedures

Examine: [SELECT FROM: Assessment, authorization, and monitoring policy and procedures; system security plan; privacy plan; other relevant documents or records]. Interview: [SELECT FROM: Organizational personnel with assessment, authorization, and monitoring policy responsibilities; organizational personnel with information security and privacy responsibilities].

Related Controls

The controls below (if any) were marked by NIST as being related to CCI-000243.

Control	Description
CA-1	a: Develop, document, and disseminate to [one of ]: 1: [one or more of "organization-level"/"mission/business process-level"/"system-level"] assessment, authorization, and monitoring policy that: (a): Addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance; and (b): Is consistent with applicable laws, executive orders, directives, regulations, policies, standards, and guidelines; and 2: Procedures to facilitate the implementation of the assessment, authorization, and monitoring policy and the associated assessment, authorization, and monitoring controls; b: Designate an [an official to manage the assessment, authorization, and monitoring policy and procedures is defined;] to manage the development, documentation, and dissemination of the assessment, authorization, and monitoring policy and procedures; and c: Review and update the current assessment, authorization, and monitoring: 1: Policy [the frequency at which the current assessment, authorization, and monitoring policy is reviewed and updated is defined;] and following [events that would require the current assessment, authorization, and monitoring policy to be reviewed and updated are defined;] ; and 2: Procedures [the frequency at which the current assessment, authorization, and monitoring procedures are reviewed and updated is defined;] and following [events that would require assessment, authorization, and monitoring procedures to be reviewed and updated are defined;].

Control

Description

CA-1

a: Develop, document, and disseminate to [one of ]:
- 1: [one or more of "organization-level"/"mission/business process-level"/"system-level"] assessment, authorization, and monitoring policy that:
  - (a): Addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance; and
  - (b): Is consistent with applicable laws, executive orders, directives, regulations, policies, standards, and guidelines; and
- 2: Procedures to facilitate the implementation of the assessment, authorization, and monitoring policy and the associated assessment, authorization, and monitoring controls;

b: Designate an [an official to manage the assessment, authorization, and monitoring policy and procedures is defined;] to manage the development, documentation, and dissemination of the assessment, authorization, and monitoring policy and procedures; and

c: Review and update the current assessment, authorization, and monitoring:
- 1: Policy [the frequency at which the current assessment, authorization, and monitoring policy is reviewed and updated is defined;] and following [events that would require the current assessment, authorization, and monitoring policy to be reviewed and updated are defined;] ; and
- 2: Procedures [the frequency at which the current assessment, authorization, and monitoring procedures are reviewed and updated is defined;] and following [events that would require assessment, authorization, and monitoring procedures to be reviewed and updated are defined;].