PM-1 Information Security Program Plan. Develop and disseminate an organization-wide information security program plan that: Provides an overview of the requirements for the security program and a description of the security program management controls and
Information Security Program Plan. Develop and disseminate an organization-wide information security program plan that: Provides an overview of the requirements for the security program and a description of the security .
5
artefacts
0
held by a system
1
at each review
hard
to go live
Document repository
where the evidence lives
teal = a system already holds it · olive = produced at each review
system holds itEvidence a system already holds
none for this control
periodic reviewEvidence produced at each review
- Dissemination evidence and the review and update records against the defined frequency and after significant change · Document repository
governing documentDocuments that govern the control
- The organisation-wide information security program plan, showing the programme overview and the requirements it covers · Policy repository / GRC workspace
- The section describing the program management controls and common controls in place or planned · Document repository
- Identification of the roles, responsibilities, management commitment and compliance approach in the plan · Policy repository / GRC workspace
- Approval by a senior official with the authority and resources named · Document repository
First move
This control is evidenced by people and documents, not systems. Put the document under version control with an owner and review date, and log each review as a record with reviewer and date. Do not try to automate it.
Common gaps auditors find
- Plan covers system level controls while the program management and common controls it exists to document are thin
- Common controls listed without naming what inherits them, so inheritance cannot be verified
- Approved once at accreditation and not refreshed after reorganisation changed the roles it names
Do this for your whole sheet
Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.
Build my evidence sheetPL-11 Baseline tailoring · PM-2 Information Security Program Leadership Role. Appoint a senior agency information security officer with the mission and resources to coordinate, develop, implement, and maintain an organization-wide information security program