Navigate

CCI-000618

CCI-000618 Definition

Identify individuals having information system security roles and responsibilities.

Status
Type	CheckType.policy

Master Assessment Datasheet

Implementation Guidance

The organization being inspected/assessed identifies and documents individuals having information system security roles and responsibilities.

Validation Procedures

The organization conducting the inspection/assessment obtains and examines the documented individuals having information system security roles and responsibilities to ensure the organization being inspected/assessed identifies individuals having information system security roles and responsibilities.

Compelling Evidence

1.) System security plan (SSP). 2.) System development life cycle (SDLC) documentation defines security roles and responsibilities.

Related Controls

The controls below (if any) were marked by NIST as being related to CCI-000618.

Control	Description
SA-3	The organization: a: Manages the information system using [organization-defined system development life cycle] that incorporates information security considerations; b: Defines and documents information security roles and responsibilities throughout the system development life cycle; c: Identifies individuals having information security roles and responsibilities; and d: Integrates the organizational information security risk management process into system development life cycle activities.

Control

Description

SA-3

The organization:

a: Manages the information system using [organization-defined system development life cycle] that incorporates information security considerations;

b: Defines and documents information security roles and responsibilities throughout the system development life cycle;

c: Identifies individuals having information security roles and responsibilities; and

d: Integrates the organizational information security risk management process into system development life cycle activities.