PM-3 Information Security and Privacy Resources. Include the resources needed to implement the information security and privacy programs in capital planning and investment requests and document all exceptions to this requirement; Prepare documentation required for
Information Security and Privacy Resources. Include the resources needed to implement the information security and privacy programs in capital planning and investment requests and document all exceptions to this requirem.
system holds itEvidence a system already holds
- Records showing the resources requested were tracked through to allocation · Document repository
periodic reviewEvidence produced at each review
none for this control
governing documentDocuments that govern the control
- Capital planning and investment requests showing security and privacy resources included · Policy repository / GRC workspace
- Documented exceptions where resources were not included, with the approval for each exception · Document repository
- The programming and budgeting documentation prepared for the security and privacy programmes · Policy repository / GRC workspace
- Evidence of a discrete line item for information security and privacy in programming and budgeting documentation · Policy repository / GRC workspace
First move
Common gaps auditors find
- Security funded within project budgets with no discrete line item, so it cannot be tracked or defended
- Exceptions taken without documentation, which the control requires explicitly
- Requests submitted and reduced in allocation with no record of the resulting unfunded risk
Do this for your whole sheet
Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.
Build my evidence sheetPM-2 Information Security Program Leadership Role. Appoint a senior agency information security officer with the mission and resources to coordinate, develop, implement, and maintain an organization-wide information security program · PM-4 Plan of Action and Milestones Process. Implement a process to ensure that plans of action and milestones for the information security, privacy, and supply chain risk management programs and associated organizational systems: Are developed