Question 1

What evidence do auditors ask for on PM-14 Testing, Training, and Monitoring. Implement a process for ensuring that organizational plans for conducting security and privacy testing, training, and monitoring activities associated with organizational systems: Are developed and maintained; and Continue to be?

Accepted Answer

Organisational plans for security and privacy testing, training and monitoring activities; The process ensuring those plans are developed, maintained and executed as written; Evidence the plans continue to be executed, such as completion records against the planned schedule; Review record confirming the plans remain consistent with the organisational risk management strategy and priorities; Records of adjustment where risk priorities changed and the plans were revised to match.

Question 2

Can PM-14 be evidenced continuously rather than by periodic review?

Accepted Answer

This control is evidenced by people and documents, not systems. Put the document under version control with an owner and review date, and log each review as a record with reviewer and date. Do not try to automate it.

Question 3

What is the most common gap auditors find on PM-14?

Accepted Answer

Plans developed and then executed only in part, with no tracking that would surface the shortfall

`PM-14` Testing, Training, and Monitoring. Implement a process for ensuring that organizational plans for conducting security and privacy testing, training, and monitoring activities associated with organizational systems: Are developed and maintained; and Continue to be

system holds itEvidence a system already holds

periodic reviewEvidence produced at each review

governing documentDocuments that govern the control

First move

Common gaps auditors find

Do this for your whole sheet