PRI-08: Testing, Training & Monitoring
Mechanisms exist to conduct cybersecurity and data privacy testing, training and monitoring activities
Control Question: Does the organization conduct cybersecurity and data privacy testing, training and monitoring activities
General (13)
| Framework | Mapping Values |
|---|---|
| AICPA TSC 2017:2022 (used for SOC 2) (source) | P8.0 P8.1-POF6 |
| Generally Accepted Privacy Principles (GAPP) | 1.2.6 10.2.3 10.2.4 10.2.5 |
| ISO 27002 2022 | 5.36 8.8 |
| ISO 27017 2015 | 18.2.2 18.2.3 |
| ISO 27018 2014 | A.10.3 |
| NIST 800-53 R4 | AR-4 |
| NIST 800-53 R5 (source) | PM-14 |
| NIST 800-53B R5 (privacy) (source) | PM-14 |
| NIST 800-161 R1 | PM-14 |
| NIST 800-161 R1 Level 1 | PM-14 |
| NIST 800-161 R1 Level 2 | PM-14 |
| PCI DSS 4.0.1 (source) | A3.1.4 |
| SCF CORE Mergers, Acquisitions & Divestitures (MA&D) | PRI-08 |
US (3)
| Framework | Mapping Values |
|---|---|
| US CERT RMM 1.2 | COMP:SG3.SP1 COMP:SG3.SP3 EXD:SG4.SP1 IMC:SG2.SP1 |
| US CMS MARS-E 2.0 | AR-4 |
| US - TX DIR Control Standards 2.0 | PM-14 |
EMEA (1)
| Framework | Mapping Values |
|---|---|
| EMEA South Africa | 19 |
APAC (1)
| Framework | Mapping Values |
|---|---|
| APAC Japan ISMAP | 18.2.2 18.2.3 |
Capability Maturity Model
Level 0 — Not Performed
There is no evidence of a capability to conduct cybersecurity and data privacy testing, training and monitoring activities
Level 1 — Performed Informally
C|P-CMM1 is N/A, since a structured process is required to conduct cybersecurity and data privacy testing, training and monitoring activities
Level 2 — Planned & Tracked
C|P-CMM2 is N/A, since a well-defined process is required to conduct cybersecurity and data privacy testing, training and monitoring activities
Level 3 — Well Defined
Privacy (PRI) efforts are standardized across the organization and centrally managed, where technically feasible, to ensure consistency. CMM Level 3 control maturity would reasonably expect all, or at least most, the following criteria to exist:
- A Chief Privacy Officer (CPO), or similar function with technical competence to address data privacy concerns, analyzes the organization's business strategy to develop and publish authoritative guidance on the organization's data privacy program.
- A Privacy program, run by a CPO, or similar role, ensures that applicable statutory, regulatory and contractual data privacy obligations are properly identified and implemented to limit and secure Personal Data (PD) that the organization stores, transmits and processes.
- As part of the organization's data privacy program, the CPO publishes a clear set of “data privacy principles”, based on leading data privacy practices, that systems, applications, services, processes and third-parties must adhere to.
- A Project Management Office (PMO), or project management function, ensures both cybersecurity and data privacy principles are identified and implemented within ongoing or planned projects.
- The Chief Information Security Officer (CISO), or similar function with technical competence to address cybersecurity concerns, analyzes the organization's business strategy to determine prioritized and authoritative guidance for cybersecurity-related data privacy practices.
- The CISO, or similar function, develops a security-focused Concept of Operations (CONOPS) that documents management, operational and technical measures to apply defense-in-depth techniques across the enterprise for cybersecurity-related data privacy practices.
- A Governance, Risk & Compliance (GRC) function, or similar function, provides governance oversight for the implementation of applicable statutory, regulatory and contractual cybersecurity and data protection controls to protect the confidentiality, integrity, availability and safety of the organization's applications, systems, services and data with regards to data privacy.
- A steering committee is formally established to provide executive oversight of the cybersecurity and data privacy program.
- Data/process owners operationalize data privacy controls into the processes they control.
- Third-party contracts included data protection requirements, including flow-down requirements to subcontractors.
- Data Protection Officers (DPOs) are assigned to work closely with business units and project teams to ensure data privacy principles are being implemented.
- CPO and DPO determine and document the legal authority that permits the collection, use, maintenance and sharing of PD, either generally or in support of a specific program or system need.
Level 4 — Quantitatively Controlled
Privacy (PRI) efforts are metrics driven and provide sufficient management insight (based on a quantitative understanding of process capabilities) to predict optimal performance, ensure continued operations and identify areas for improvement. In addition to CMM Level 3 criteria, CMM Level 4 control maturity would reasonably expect all, or at least most, the following criteria to exist:
- Metrics reporting includes quantitative analysis of Key Performance Indicators (KPIs).
- Metrics reporting includes quantitative analysis of Key Risk Indicators (KRIs).
- Scope of metrics, KPIs and KRIs covers organization-wide cybersecurity and data protection controls, including functions performed by third-parties.
- Organizational leadership maintains a formal process to objectively review and respond to metrics, KPIs and KRIs (e.g., monthly or quarterly review).
- Based on metrics analysis, process improvement recommendations are submitted for review and are handled in accordance with change control processes.
- Both business and technical stakeholders are involved in reviewing and approving proposed changes.
Level 5 — Continuously Improving
See C|P-CMM4. There are no defined C|P-CMM5 criteria, since it is reasonable to assume a continuously-improving process is not necessary to conduct cybersecurity and data privacy testing, training and monitoring activities
Assessment Objectives
- PRI-08_A01 a process is implemented for ensuring that organizational plans for conducting cybersecurity / data privacy testing, training and monitoring activities associated with organizational systems are developed.
- PRI-08_A02 a process is implemented for ensuring that organizational plans for conducting cybersecurity / data privacy testing, training and monitoring activities associated with organizational systems are maintained.
- PRI-08_A03 a process is implemented for ensuring that organizational plans for conducting cybersecurity / data privacy testing, training and monitoring activities associated with organizational systems continue to be executed.
- PRI-08_A04 testing plans are reviewed for consistency with the organizational risk management strategy.
- PRI-08_A05 training plans are reviewed for consistency with the organizational risk management strategy.
- PRI-08_A06 monitoring plans are reviewed for consistency with the organizational risk management strategy.
- PRI-08_A07 testing plans are reviewed for consistency with organization-wide priorities for risk response actions.
- PRI-08_A08 training plans are reviewed for consistency with organization-wide priorities for risk response actions.
- PRI-08_A09 monitoring plans are reviewed for consistency with organization-wide priorities for risk response actions.
Technology Recommendations
Micro/Small
- Data classification program
- Data privacy program
- Data Protection Impact Assessment (DPIA)
- Product / project management
Small
- Data classification program
- Data privacy program
- Data Protection Impact Assessment (DPIA)
- Product / project management
Medium
- Data classification program
- Data privacy program
- Data Protection Impact Assessment (DPIA)
- Product / project management
Large
- Data classification program
- Data privacy program
- Data Protection Impact Assessment (DPIA)
- Product / project management
Enterprise
- Data classification program
- Data privacy program
- Data Protection Impact Assessment (DPIA)
- Product / project management