GV.PO-P2: Processes to instill organizational privacy values within system/product/service development and operations are established and in place
Description
[csf.tools Note: Subcategories do not have detailed descriptions.]
Related Controls
NIST Special Publication 800-53 Revision 5
PM-3: Information Security and Privacy Resources
Include the resources needed to implement the information security and privacy programs in capital planning and investment requests and document all exceptions to this requirement; Prepare documentation required for addressing information security and privacy programs in capital planning and investment requests in accordance with applicable laws, executive orders, directives, policies, regulations, standards; and Make available…
PM-23: Data Governance Body
Establish a Data Governance Body consisting of [Assignment: organization-defined roles] with [Assignment: organization-defined responsibilities].
SA-2: Allocation of Resources
Determine the high-level information security and privacy requirements for the system or system service in mission and business process planning; Determine, document, and allocate the resources required to protect the system or system service as part of the organizational capital planning and investment control process; and Establish a discrete line item for information security and…
SA-3: System Development Life Cycle
Acquire, develop, and manage the system using [Assignment: organization-defined system development life cycle] that incorporates information security and privacy considerations; Define and document information security and privacy roles and responsibilities throughout the system development life cycle; Identify individuals having information security and privacy roles and responsibilities; and Integrate the organizational information security and privacy risk…
NIST Special Publication 800-53 Revision 4
PM-3: Information Security Resources
The organization: Ensures that all capital planning and investment requests include the resources needed to implement the information security program and documents all exceptions to this requirement; Employs a business case/Exhibit 300/Exhibit 53 to record the resources required; and Ensures that information security resources are available for expenditure as planned.
SA-2: Allocation Of Resources
The organization: Determines information security requirements for the information system or information system service in mission/business process planning; Determines, documents, and allocates the resources required to protect the information system or information system service as part of its capital planning and investment control process; and Establishes a discrete line item for information security in organizational…
SA-3: System Development Life Cycle
The organization: Manages the information system using [Assignment: organization-defined system development life cycle] that incorporates information security considerations; Defines and documents information security roles and responsibilities throughout the system development life cycle; Identifies individuals having information security roles and responsibilities; and Integrates the organizational information security risk management process into system development life cycle activities.