IAO-06: Technical Verification

IAO 8 — High Protect

Mechanisms exist to perform Information Assurance Program (IAP) activities to evaluate the design, implementation and effectiveness of technical cybersecurity and data protection controls.

Control Question: Does the organization perform Information Assurance Program (IAP) activities to evaluate the design, implementation and effectiveness of technical cybersecurity and data protection controls?

General (37)

Framework	Mapping Values
AICPA TSC 2017:2022 (used for SOC 2) (source)	CC4.1
COSO 2017	Principle 16
CSA IoT SCF 2	IOT-01
ENISA 2.0	SO24
GovRAMP Low	CA-02
GovRAMP Low+	CA-02
GovRAMP Moderate	CA-02
GovRAMP High	CA-02
IMO Maritime Cyber Risk Management	3.5.3.3
ISO/SAE 21434 2021	RQ-09-07.a RQ-09-07.b RQ-09-07.c RQ-09-07.d
ISO 31010 2009	5.3.2 5.3.3 5.3.4 5.3.5 5.3.6
ISO 42001 2023	A.6.2.5
MITRE ATT&CK 10	T1190, T1195, T1195.001, T1195.002, T1210
NIST AI 100-1 (AI RMF) 1.0	MEASURE 2.0
NIST 800-37 R2	A-3
NIST 800-53 R4	CA-2 CM-4(2)
NIST 800-53 R4 (low)	CA-2
NIST 800-53 R4 (moderate)	CA-2
NIST 800-53 R4 (high)	CA-2
NIST 800-53 R5 (source)	CA-2 CM-4(2)
NIST 800-53B R5 (privacy) (source)	CA-2
NIST 800-53B R5 (low) (source)	CA-2
NIST 800-53B R5 (moderate) (source)	CA-2 CM-4(2)
NIST 800-53B R5 (high) (source)	CA-2 CM-4(2)
NIST 800-82 R3 LOW OT Overlay	CA-2
NIST 800-82 R3 MODERATE OT Overlay	CA-2 CM-4(2)
NIST 800-82 R3 HIGH OT Overlay	CA-2 CM-4(2)
NIST 800-161 R1	CA-2
NIST 800-161 R1 C-SCRM Baseline	CA-2
NIST 800-161 R1 Level 2	CA-2
NIST 800-161 R1 Level 3	CA-2
UN R155	7.3.6
UN ECE WP.29	7.3.6
SCF CORE Mergers, Acquisitions & Divestitures (MA&D)	IAO-06
SCF CORE ESP Level 1 Foundational	IAO-06
SCF CORE ESP Level 2 Critical Infrastructure	IAO-06
SCF CORE ESP Level 3 Advanced Threats	IAO-06

US (10)

Framework	Mapping Values
US CERT RMM 1.2	RISK:SG3.SP1
US CISA CPG 2022	2.Q
US CMS MARS-E 2.0	CA-2 CM-4(2)
US FedRAMP R5 (source)	CM-4(2)
US FedRAMP R5 (moderate) (source)	CM-4(2)
US FedRAMP R5 (high) (source)	CM-4(2)
US IRS 1075	CA-2 CM-4(2)
US NISPOM 2020	8-610
US - CA CCPA 2025	7123(c)(4)(C)
US - TX DIR Control Standards 2.0	CA-2

EMEA (3)

Framework	Mapping Values
EMEA EU EBA GL/2019/04	3.6.2(70) 3.6.2(71)
EMEA Israel CDMO 1.0	10.6 16.5
EMEA UK DEFSTAN 05-138	1205

Capability Maturity Model

Level 0 — Not Performed

There is no evidence of a capability to perform Information Assurance Program (IAP) activities to evaluate the design, implementation and effectiveness of technical cybersecurity and data protection controls.

Level 1 — Performed Informally

Information Assurance (IA) is ad hoc and inconsistent. CMM Level 1 control maturity would reasonably expect all, or at least most, the following criteria to exist:

Pre-production security testing is decentralized.
IT personnel implement and maintain an informal process to conduct limited control testing of High Value Assets (HVAs) to meet specific statutory, regulatory and/ or contractual requirements for pre-production cybersecurity and data protection control testing.

Level 2 — Planned & Tracked

Information Assurance (IA) is requirements-driven and governed at a local/regional level, but not consistently across the enterprise. CMM Level 2 control maturity would reasonably expect all, or at least most, the following criteria to exist:

Pre-production security testing is decentralized (e.g., a localized/regionalized function) and uses non-standardized methods to implement secure, resilient and compliant practices.
IT/cybersecurity personnel identify cybersecurity and data protection controls that are appropriate to address applicable statutory, regulatory and contractual requirements for pre-production cybersecurity and data protection control testing.
IT personnel implement and maintain an established a limited Information Assurance Program (IAP) capability to conduct limited control testing to meet specific statutory, regulatory and/ or contractual requirements for pre-production cybersecurity and data protection control testing.
IAP operations focus on protecting High Value Assets (HVAs), including environments where sensitive/regulated data is stored, transmitted and processed.

Level 3 — Well Defined

Information Assurance (IA) is standardized across the enterprise and centrally managed, where technically feasible, to ensure consistency. CMM Level 3 control maturity would reasonably expect all, or at least most, the following criteria to exist:

Cybersecurity personnel implement and maintain an established Information Assurance Program (IAP) capability to conduct “business as usual” pre-production cybersecurity and data protection control testing focused on the concept of “security and data protection be design and by default.”
The IAP validates that systems/applications/services/processes are both secure and compliant.
A Governance, Risk & Compliance (GRC) function, or similar function, facilitates the implementation of cybersecurity and data protection controls to ensure that secure engineering practices are designed and implemented throughout the lifecycle of systems, applications and services both internal and external to the organization.
A Project Management Office (PMO), or project management function, ensures project involvement for IAP as part of the organization's established project management processes.
A Plan of Action and Milestones (POA&M) or similar mechanism, exists to document planned remediation actions to correct weaknesses or deficiencies noted during the assessment of the security controls, helping to reduce or eliminate known vulnerabilities.
Administrative processes prevent systems/applications/services/processes from “going live” in a production environment without first going through the IAP process.
The IAP uses a tiered approach to conformity testing, based on (1) the sensitivity of data that is stored, processed and/ or transmitted and (2) the criticality of the system/application/service/process.

Level 4 — Quantitatively Controlled

Information Assurance (IA) is metrics driven and provides sufficient management insight (based on a quantitative understanding of process capabilities) to predict optimal performance, ensure continued operations and identify areas for improvement. In addition to CMM Level 3 criteria, CMM Level 4 control maturity would reasonably expect all, or at least most, the following criteria to exist:

Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).
Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).
Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.
Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).
Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.
Both business and technical stakeholders are involved in the review process for proposed changes.

Level 5 — Continuously Improving

See C|P-CMM4. There are no defined C|P-CMM5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to perform Information Assurance Program (IAP) activities to evaluate the design, implementation and effectiveness of technical cybersecurity and data protection controls.

Assessment Objectives

IAO-06_A01 the frequency at which to assess controls in the system and its environment of operation is defined.
IAO-06_A02 individuals or roles to whom control assessment results are to be provided are defined.
IAO-06_A03 an appropriate assessor or assessment team is selected for the type of assessment to be conducted.
IAO-06_A04 a control assessment plan is developed that describes the scope of the assessment, including controls and control enhancements under assessment.
IAO-06_A05 the control assessment plan is reviewed and approved by the authorizing official or designated representative prior to conducting the assessment.
IAO-06_A06 controls are assessed in the system and its environment of operation per an organization-defined assessment frequency to determine the extent to which the controls are implemented correctly, operating as intended and producing the desired outcome with respect to meeting established cybersecurity / data privacy requirements.
IAO-06_A07 a control assessment report is produced that documents the results of the assessment.
IAO-06_A08 the results of the control assessment are provided to individuals or roles.
IAO-06_A09 the impacted controls are implemented correctly with regard to meeting the cybersecurity / data privacy requirements for the system after system changes.
IAO-06_A10 the impacted controls are operating as intended with regard to meeting the cybersecurity / data privacy requirements for the system after system changes.
IAO-06_A11 the impacted controls are producing the desired outcome with regard to meeting the cybersecurity / data privacy requirements for the system after system changes.
IAO-06_A12 a control assessment plan is developed that describes the scope of the assessment, including assessment procedures to be used to determine control effectiveness.
IAO-06_A13 a control assessment plan is developed that describes the scope of the assessment, including the assessment environment.
IAO-06_A14 a control assessment plan is developed that describes the scope of the assessment, including the assessment team.
IAO-06_A15 a control assessment plan is developed that describes the scope of the assessment, including assessment roles and responsibilities.

Technology Recommendations

Micro/Small

Controls Validation Testing (CVT)

Small

Controls Validation Testing (CVT)

Medium

Controls Validation Testing (CVT)

Large

Controls Validation Testing (CVT)

Enterprise

Controls Validation Testing (CVT)