PM-32 Purposing. Analyze [organization-defined] supporting mission essential services or functions to ensure that the information resources are being used consistent with their intended purpose
Purposing. Analyze [organization-defined] supporting mission essential services or functions to ensure that the information resources are being used consistent with their intended purpose.
system holds itEvidence a system already holds
none for this control
periodic reviewEvidence produced at each review
- Review record showing the analysis is repeated at the defined frequency · Document repository
governing documentDocuments that govern the control
- List of mission essential services and functions, and the information resources supporting each · Document repository
- The documented analysis of whether those resources are used consistently with their intended purpose · Document repository
- Definition of the intended purpose against which each resource was analysed · Document repository
- Findings where resource use had drifted from intended purpose, and the action taken · Document repository
First move
Common gaps auditors find
- Intended purpose never documented at commissioning, so drift cannot be detected
- Analysis performed on production systems while shared platforms serving many purposes are excluded
- Findings recorded with no action, so repurposed resources continue outside their authorisation
Do this for your whole sheet
Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.
Build my evidence sheetPM-31 Continuous Monitoring Strategy. Develop an organization-wide continuous monitoring strategy and implement continuous monitoring programs that include: Establishing the following organization-wide metrics to be monitored: [organization-defined]; Establishing [organization-defined] and [organization-defined] for control effectiveness; Ongoing monitoring · PS-1 Policy and procedures for personnel security