PM-7 Enterprise Architecture. Develop and maintain an enterprise architecture with consideration for information security, privacy, and the resulting risk to organizational operations and assets, individuals, other organizations, and the Nation
Enterprise Architecture. Develop and maintain an enterprise architecture with consideration for information security, privacy, and the resulting risk to organizational operations and assets, individuals, other organizati.
5
artefacts
1
held by a system
3
at each review
hard
to go live
Cloud console / configuration management
where the evidence lives
teal = a system already holds it · olive = produced at each review
system holds itEvidence a system already holds
- Maintenance records showing the architecture is updated as the estate changes · Cloud console / configuration management
periodic reviewEvidence produced at each review
- Risk assessment results for the enterprise architecture itself · Cloud console / configuration management
- Evidence architecture decisions record the resulting risk to operations, assets and individuals · Cloud console / configuration management
- Evidence system level designs are checked against the enterprise architecture · Cloud console / configuration management
governing documentDocuments that govern the control
- Enterprise architecture documentation showing information security and privacy considerations embedded in it · Policy repository / GRC workspace
First move
Mostly documents and reviews. Pull the 1 system-held artefact from your Cloud console / configuration management on a schedule; put the documents under version control with an owner and review date, and log each review as a dated record with a named reviewer.
Common gaps auditors find
- Security architecture maintained as a separate document that the enterprise architecture does not reference
- Architecture describes the target state with no view of the current estate, so risk cannot be assessed against reality
- Privacy considerations absent, leaving data flows and processing purposes outside the architecture
Do this for your whole sheet
Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.
Build my evidence sheetPM-6 Measures of Performance. Develop, monitor, and report on the results of information security and privacy measures of performance · PM-8 Critical Infrastructure Plan. Address information security and privacy issues in the development, documentation, and updating of a critical infrastructure and key resources protection plan