Navigate

CCI-003849

CCI-003849 Definition

Disseminate an organization-level; mission/business process; system-level assessment, authorization, and monitoring policy that is consistent with applicable laws, Executive Orders, directives, regulations, policies, standards, and guidelines.

Status
Type	CheckType.policy

Master Assessment Datasheet

Implementation Guidance

Determine if the [CA-01_ODP[03]; one or more of the following PARAMETER VALUES is/are selected: {organization-level; mission/business process-level; system-level}] assessment, authorization, and monitoring policy is consistent with applicable laws, executive orders, directives, regulations, policies, standards, and guidelines.

Validation Procedures

Examine: [SELECT FROM: Assessment, authorization, and monitoring policy and procedures; system security plan; privacy plan; other relevant documents or records]. Interview: [SELECT FROM: Organizational personnel with assessment, authorization, and monitoring policy responsibilities; organizational personnel with information security and privacy responsibilities].

Related Controls

The controls below (if any) were marked by NIST as being related to CCI-003849.

Control	Description
CA-1	a: Develop, document, and disseminate to [one of ]: 1: [one or more of "organization-level"/"mission/business process-level"/"system-level"] assessment, authorization, and monitoring policy that: (a): Addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance; and (b): Is consistent with applicable laws, executive orders, directives, regulations, policies, standards, and guidelines; and 2: Procedures to facilitate the implementation of the assessment, authorization, and monitoring policy and the associated assessment, authorization, and monitoring controls; b: Designate an [an official to manage the assessment, authorization, and monitoring policy and procedures is defined;] to manage the development, documentation, and dissemination of the assessment, authorization, and monitoring policy and procedures; and c: Review and update the current assessment, authorization, and monitoring: 1: Policy [the frequency at which the current assessment, authorization, and monitoring policy is reviewed and updated is defined;] and following [events that would require the current assessment, authorization, and monitoring policy to be reviewed and updated are defined;] ; and 2: Procedures [the frequency at which the current assessment, authorization, and monitoring procedures are reviewed and updated is defined;] and following [events that would require assessment, authorization, and monitoring procedures to be reviewed and updated are defined;].

Control

Description

CA-1

a: Develop, document, and disseminate to [one of ]:
- 1: [one or more of "organization-level"/"mission/business process-level"/"system-level"] assessment, authorization, and monitoring policy that:
  - (a): Addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance; and
  - (b): Is consistent with applicable laws, executive orders, directives, regulations, policies, standards, and guidelines; and
- 2: Procedures to facilitate the implementation of the assessment, authorization, and monitoring policy and the associated assessment, authorization, and monitoring controls;

b: Designate an [an official to manage the assessment, authorization, and monitoring policy and procedures is defined;] to manage the development, documentation, and dissemination of the assessment, authorization, and monitoring policy and procedures; and

c: Review and update the current assessment, authorization, and monitoring:
- 1: Policy [the frequency at which the current assessment, authorization, and monitoring policy is reviewed and updated is defined;] and following [events that would require the current assessment, authorization, and monitoring policy to be reviewed and updated are defined;] ; and
- 2: Procedures [the frequency at which the current assessment, authorization, and monitoring procedures are reviewed and updated is defined;] and following [events that would require assessment, authorization, and monitoring procedures to be reviewed and updated are defined;].