Risk Management Framework

Appendix D: Assessment Method Definitions, Applicable Objects, and Attributes

The following paragraphs are reproduced from NIST SP 800-53A Revision 1. This appendix can assist the security control assessor with defining the depth and coverage required for the assessment of each security control. It is recommended that the reader verify that this information is accurate and up to date by validating it on the NIST website.

Examine Assessment Method

ASSESSMENT METHOD: Examine

ASSESSMENT OBJECTS: Specifications (e.g., policies, plans, procedures, system requirements, designs)

Mechanisms (e.g., functionality implemented in hardware, software, firmware)

Activities (e.g., system operations, administration, management, exercises)

DEFINITION: The process ...