PL-9 Central Management. Centrally manage [organization-defined]
Central Management. Centrally manage [organization-defined].
5
artefacts
1
held by a system
2
at each review
hard
to go live
Document repository
where the evidence lives
teal = a system already holds it · olive = produced at each review
system holds itEvidence a system already holds
- Records showing system owners were informed of what they inherit and what remains their responsibility · Document repository
periodic reviewEvidence produced at each review
- Evidence that the centrally managed implementation actually applies to the systems claiming inheritance · Document repository
- Change and review records for the centrally managed implementations · Document repository
governing documentDocuments that govern the control
- The defined list of controls and control enhancements designated for central management · Document repository
- For each, identification of the organisational entity that manages it centrally and the mechanism used · Document repository
First move
Mostly documents and reviews. Pull the 1 system-held artefact from your Document repository on a schedule; put the documents under version control with an owner and review date, and log each review as a dated record with a named reviewer.
Common gaps auditors find
- Systems claim inheritance of a central control that does not in fact cover their platform or region
- Central management asserted with no named owner, so no one maintains the implementation
- Boundary between central and system responsibility undocumented, leaving parts of the control unimplemented by both
Do this for your whole sheet
Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.
Build my evidence sheetPL-8 Security and privacy architectures · PL-10 Baseline selection