Navigate

CCI-000248

CCI-000248 Definition

Develop a control assessment plan that describes the scope of the assessment including assessment environment.

Status
Type	CheckType.policy

Master Assessment Datasheet

Implementation Guidance

The organization being inspected/assessed will provide a description of the authorization boundary in their Security Plan. Authorization boundary can be described via one or more of the following: network diagrams, data flow diagrams, system design documents, or a list of information system components. Authorization boundary as defined in CNSSI 4009. *Comment* The items required within this control are being split into the security plan and security assessment report to eliminate creation of an additional artifact.

Validation Procedures

The organization conducting the inspection/assessment obtains and examines the organization's authorization boundary. Authorization boundary can be described via one or more of the following: network diagrams, data flow diagrams, system design documents, or a list of information system components.

Compelling Evidence

1.) Signed and dated Security Assessment Plan which defines the organization's authorization boundary

Related Controls

The controls below (if any) were marked by NIST as being related to CCI-000248.

Control	Description
CA-2	The organization: a: Develops a security assessment plan that describes the scope of the assessment including: 1: Security controls and control enhancements under assessment; 2: Assessment procedures to be used to determine security control effectiveness; and 3: Assessment environment, assessment team, and assessment roles and responsibilities; b: Assesses the security controls in the information system and its environment of operation [organization-defined frequency] to determine the extent to which the controls are implemented correctly, operating as intended, and producing the desired outcome with respect to meeting established security requirements; c: Produces a security assessment report that documents the results of the assessment; and d: Provides the results of the security control assessment to [organization-defined individuals or roles].

Control

Description

CA-2

The organization:

a: Develops a security assessment plan that describes the scope of the assessment including:
- 1: Security controls and control enhancements under assessment;
- 2: Assessment procedures to be used to determine security control effectiveness; and
- 3: Assessment environment, assessment team, and assessment roles and responsibilities;

b: Assesses the security controls in the information system and its environment of operation [organization-defined frequency] to determine the extent to which the controls are implemented correctly, operating as intended, and producing the desired outcome with respect to meeting established security requirements;

c: Produces a security assessment report that documents the results of the assessment; and

d: Provides the results of the security control assessment to [organization-defined individuals or roles].