Applicable

(Y)es / (N)o

(C)onfidentiality

(I)ntegrity

(A)vailability

RPN

(C+I+A)

(S)atisfactory

L1

M2

H3

L1

M2

H3

L1

M2

H3

(O)ther than satisfactory +##

pl-7

security concept of operations

assessment objective:

Determine if the organization:  

pl-7(a)  

develops a security Concept of Operations (CONOPS) for the information system containing at a minimum, how the organization intends to operate the system from the perspective of information security;

pl-7(b)  

pl-7(b)[1]

defines the frequency to review and update the security CONOPS; and

pl-7(b)[2]

reviews and updates the security CONOPS with the organization-defined frequency.

potential assessment methods and objects:

Examine: [SELECT FROM: Security planning policy; procedures addressing security CONOPS development; procedures addressing security CONOPS reviews and updates; security CONOPS for the information system; security plan for the information system; records of security CONOPS reviews and updates; other relevant documents or records].

Interview: [select from: Organizational personnel with security planning and plan implementation responsibilities; organizational personnel with information security responsibilities].

Test: [select from: Organizational processes for developing, reviewing, and updating the security CONOPS; automated mechanisms supporting and/or implementing the development, review, and update of the security CONOPS].