Applicable

(Y)es / (N)o

(C)onfidentiality

(I)ntegrity

(A)vailability

RPN

(C+I+A)

(S)atisfactory

L1

M2

H3

L1

M2

H3

L1

M2

H3

(O)ther than satisfactory +##

sc-38

operations security

assessment objective: SC-39 PROCESS ISOLATION

Determine if the organization:

sc-38[1]

defines operations security safeguards to be employed to protect key organizational information throughout the system development life cycle; and

sc-38[2]

employs organization-defined operations security safeguards to protect key organizational information throughout the system development life cycle.

potential assessment methods and objects:

Examine: [SELECT FROM: System and communications protection policy; procedures addressing operations security; security plan; list of operations security safeguards; security control assessments; risk assessments; threat and vulnerability assessments; plans of action and milestones; system development life cycle documentation; other relevant documents or records].

Interview: [select from: System/network administrators; organizational personnel with information security responsibilities; organizational personnel installing, configuring, and/or maintaining the information system; information system developers/integrators].

Test: [select from: Organizational processes for protecting organizational information throughout the SDLC; automated mechanisms supporting and/or implementing safeguards to protect organizational information throughout the SDLC].