SI-1 Policy and procedures for system and information integrity
Requires a system and information integrity policy with supporting procedures to be developed, approved, disseminated to defined personnel, owned by a named official, and reviewed and updated on a defined frequency and a
system holds itEvidence a system already holds
none for this control
periodic reviewEvidence produced at each review
none for this control
governing documentDocuments that govern the control
- Approved system and information integrity policy with scope, approver and date · Policy repository / GRC workspace
- Evidence the system and information integrity policy reached the personnel or roles it defines · Policy repository / GRC workspace
- Written designation of the official accountable for the system and information integrity policy and procedures · Policy repository / GRC workspace
- Procedures covering flaw remediation, malicious code protection and monitoring · Policy repository / GRC workspace
- Review record for the system and information integrity policy and procedures against the defined frequency and triggering events · Policy repository / GRC workspace
First move
Common gaps auditors find
- Policy sets no patching timeframes, leaving remediation open ended
- Monitoring responsibilities undefined between operations and security
- No review cadence defined for the system and information integrity policy, so it silently ages
Do this for your whole sheet
Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.
Build my evidence sheetSC-51 Hardware-based Protection. Employ hardware-based, write-protect for [organization-defined] ; and Implement specific procedures for [organization-defined] to manually disable hardware write-protect for firmware modifications and re-enable the write-protect prior to returning to operational mode · SI-2 Flaw remediation