CCI-004346

Manage the security state of organizational systems and the environments in which those systems operate through authorization processes.

Implementation Guidance

Determine if: - the security state of Organizational systems and the environments in which those systems operate are managed through authorization processes. - the privacy state of Organizational systems and the environments in which those systems operate are managed through authorization processes.

Validation Procedures

Examine: [SELECT FROM: Information security program plan; privacy program plan; procedures addressing management (i.e., documentation, tracking, and reporting) of the authorization process; assessment, authorization, and monitoring policy; assessment, authorization, and monitoring procedures; system authorization documentation; lists or other documentation about authorization process roles and responsibilities; risk assessment results relevant to the authorization process and the organization-wide risk management program; organizational risk management strategy; other relevant documents or records]. Interview: [SELECT FROM: Organizational personnel with information security and privacy program planning and plan implementation responsibilities; organizational personnel responsible for management of the authorization process; organizational personnel with information security and privacy responsibilities]. Test: [SELECT FROM: Organizational processes for authorization; mechanisms supporting the authorization process].

The controls below (if any) were marked by NIST as being related to CCI-004346.