PM-6 Measures of Performance. Develop, monitor, and report on the results of information security and privacy measures of performance
Measures of Performance. Develop, monitor, and report on the results of information security and privacy measures of performance.
5
artefacts
0
held by a system
2
at each review
hard
to go live
Document repository
where the evidence lives
teal = a system already holds it · olive = produced at each review
system holds itEvidence a system already holds
none for this control
periodic reviewEvidence produced at each review
- Evidence the measures are monitored over time rather than produced once, showing trend · Document repository
- Records where a measure prompted a change to the programme · Document repository
governing documentDocuments that govern the control
- The defined information security and privacy measures of performance and what each is intended to show · Policy repository / GRC workspace
- Collected measurement data for the reporting period, with its source · Document repository
- Reports of the measurement results and the audience they were issued to · Document repository
First move
This control is evidenced by people and documents, not systems. Put the document under version control with an owner and review date, and log each review as a record with reviewer and date. Do not try to automate it.
Common gaps auditors find
- Measures count activity such as tickets closed rather than performance of the security and privacy programme
- Data collected but never reported, so the measurement loop does not close
- Privacy measures absent while security measures are well developed
Do this for your whole sheet
Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.
Build my evidence sheetPM-5 System Inventory. Develop and update [organization-defined] an inventory of organizational systems · PM-7 Enterprise Architecture. Develop and maintain an enterprise architecture with consideration for information security, privacy, and the resulting risk to organizational operations and assets, individuals, other organizations, and the Nation