CCI-004497

Defines the systems or system components that are used to analyze mission essential services or functions.

Implementation Guidance

Determine if [PM-32_ODP; the systems or system components supporting mission-essential services or functions are defined] supporting mission-essential services or functions are analyzed to ensure that the information resources are being used in a manner that is consistent with their intended purpose.

Validation Procedures

Examine: [SELECT FROM: Information security program plan; privacy program plan; list of essential services and functions; organizational analysis of information resources; risk management strategy; other relevant documents or records.]. Interview: [SELECT FROM: Organizational personnel with information security, privacy, and supply chain risk management program responsibilities].

The controls below (if any) were marked by NIST as being related to CCI-004497.