-: Now that your controls are implemented, 2 2
you'll have to assess them 3 3
to make sure they're correctly configured, 4 4
operating as you intended, 5 5
and producing the needed outcomes for your system. 6 6
There are six tasks in step number five, 7 7
and this step is called assess. 8 8
Now, let's go through the tasks together. 9 9
When you complete task A-1, 10 10
you'll have an assessor or an assessment team 11 11
selected to evaluate your controls. 12 12
No matter who does step number five, 13 13
your senior security and privacy officers 14 14
will be responsible for making sure the assessments 15 15
are complete and documented. 16 16
As you select your assessors, 17 17
keep in mind that they must have 18 18
enough feelings of independence 19 19
to be able to make truthful judgements. 20 20
Among other factors in play, 21 21
their level of independence will be affected 22 22
by whether your assessors are in-house versus contracted. 23 23
Now, when you complete task A-2, 24 24
you'll have developed, reviewed, and approved the plans 25 25
that you'll follow to assess your controls. 26 26
Now, these plans should be created by the assessors 27 27
that you selected in task A-1. 28 28
They can make a plan for the assessment 29 29
that is either a single integrated plan 30 30
for both security and privacy controls, 31 31
or they can be two plans, one for each category. 32 32
Assessment plans should also include an evaluation 33 33
of the control objectives 34 34
and the assessment procedures for each control. 35 35
Once the assessment plans are created, 36 36
they should be reviewed and approved 37 37
by the authorizing official. 38 38
Your next task is A-3. 39 39
When it's finished, 40 40
your controls assessment will be complete, 41 41
and you'll have evidence that the assessments happened. 42 42
It might be appropriate to apply and assess controls 43 43
throughout your system development life cycle 44 44
if you have an iterative development process. 45 45
Something similar is done when assessing controls 46 46
in commercial IT products. 47 47
You'll also have the option to begin assessing controls 48 48
prior to finishing the implementation 49 49
of all the controls in your security and privacy plans. 50 50
This type of incremental assessment 51 51
might be more cost efficient or cost effective for you. 52 52
When you finish task A-4, 53 53
you'll have security and privacy assessment reports 54 54
that detail all the assessor's findings and recommendations. 55 55
The amount of detail in the report should be appropriate 56 56
to the type of control assessment that was conducted. 57 57
Superficial assessment reports may be questioned or rejected 58 58
by the authorizing official. 59 59
Control assessment results can be documented 60 60
in interim reports. 61 61
Having interim reports for different assessments 62 62
during phases of the SDLC, 63 63
reinforces the fact that assessment reports 64 64
are in fact evolving documents. 65 65
Your interim reports then inform 66 66
the final assessment report. 67 67
Your next task, A-5, begins the remediation actions. 68 68
By the end of task A-5, 69 69
you'll have completed your initial remediations 70 70
based on your security and privacy assessment reports. 71 71
Then, you'll update your original reports 72 72
to include any changes that you made 73 73
to the control implementations. 74 74
If significant security or privacy risks 75 75
are discovered during the assessment, 76 76
then those should be mitigated as soon as possible. 77 77
Less severe risks that are quick and easy to mitigate 78 78
can be done later. 79 79
However, it may be more practical 80 80
to conduct initial mitigations for assessment findings 81 81
that are easy to fix with existing resources. 82 82
Your organization can prepare an addendum 83 83
to your security and privacy assessment reports 84 84
that provides an opportunity 85 85
for system owners and control providers 86 86
to respond to your assessment. 87 87
This addendum could have information 88 88
about initial mitigation actions 89 89
and additional details about the findings. 90 90
Findings from control assessments may lead 91 91
to needing an update to your system risk assessment 92 92
and your organization risk assessment as well. 93 93
Your next task is A-6, 94 94
and when you finish it, 95 95
you'll have a plan of action and milestones 96 96
that's also known as a POAM, 97 97
and it'll show you how to mitigate the deficiencies 98 98
that are contained in the security 99 99
and privacy assessment reports. 100 100
Your POAM will describe the actions 101 101
that are planned to correct the deficiencies 102 102
in your controls 103 103
that were discovered during the assessment of the controls, 104 104
as well as during continuous monitoring. 105 105
A POAM also includes the tasks to be accomplished, 106 106
recommendations for completion 107 107
before or after system authorization, 108 108
the resources required to accomplish the tasks, 109 109
milestones established to meet the task, 110 110
and scheduled completion dates 111 111
for the milestones and the tasks. 112 112
All right, that's all the tasks in step number five 113 113
which is called assess.