SI-22 Information Diversity. Identify the following alternative sources of information for [organization-defined]: [organization-defined] ; and Use an alternative information source for the execution of essential functions or services on [organization-defined] when the primary source of
Information Diversity. Identify the following alternative sources of information for [organization-defined]: [organization-defined] ; and Use an alternative information source for the execution of essential functions or .
system holds itEvidence a system already holds
none for this control
periodic reviewEvidence produced at each review
- Evidence the alternative source is genuinely independent of the primary in origin and supply · Document repository
- Records of use of an alternative source when the primary was compromised or unavailable · Document repository
- Assessment of the alternative source's accuracy and timeliness relative to the primary · Document repository
governing documentDocuments that govern the control
- The defined essential functions or services in scope and the alternative information sources identified for each · Policy repository / GRC workspace
- The defined circumstances under which the alternative source is used · Document repository
First move
Common gaps auditors find
- Alternative source that ultimately derives from the same upstream provider as the primary
- Alternative identified but never validated, so its quality is unknown at the moment of need
- Switching criteria undefined, so the alternative is adopted late or not at all
Do this for your whole sheet
Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.
Build my evidence sheetSI-21 Information Refresh. Refresh [organization-defined] at [organization-defined] or generate the information on demand and delete the information when no longer needed · SI-23 Information Fragmentation. Based on [organization-defined]: Fragment the following information: [organization-defined] ; and Distribute the fragmented information across the following systems or system components: [organization-defined]