CCI-003075

Develop security architectures for the system that describe any assumptions about, and dependencies on, external systems and services.

Implementation Guidance

Determine if: - a security architecture for the system describes any assumptions about and dependencies on external systems and services. - a privacy architecture for the system describes any assumptions about and dependencies on external systems and services.

Validation Procedures

Examine: [SELECT FROM: Security and privacy planning policy; procedures addressing information security and privacy architecture development; procedures addressing information security and privacy architecture reviews and updates; enterprise architecture documentation; information security and privacy architecture documentation; system security plan; privacy plan; security and privacy CONOPS for the system; records of information security and privacy architecture reviews and updates; other relevant documents or records]. Interview: [SELECT FROM: Organizational personnel with security and privacy planning and plan implementation responsibilities; organizational personnel with information security and privacy architecture development responsibilities; organizational personnel with information security and privacy responsibilities]. Test: [SELECT FROM: Organizational processes for developing, reviewing, and updating the information security and privacy architecture; mechanisms supporting and/or implementing the development, review, and update of the information security and privacy architecture].

The controls below (if any) were marked by NIST as being related to CCI-003075.