GV.PO-P2: Processes to instill organizational privacy values within system/product/service development and operations are established and in place
Threats Addressed:
Description
[csf.tools Note: Subcategories do not have detailed descriptions.]
Related Controls
NIST Special Publication 800-53 Revision 5.2.0
PM-3: Information Security and Privacy Resources
Include the resources needed to implement the information security and privacy programs in capital planning and investment requests and document all exceptions to this requirement; Prepare documentation required for addressing information security and privacy programs in capital planning and investment requests in accordance with applicable laws, executive orders, directives, policies, regulations, standards; and Make available…
PM-23: Data Governance Body
Establish a Data Governance Body consisting of [Assignment: organization-defined roles] with [Assignment: organization-defined responsibilities].
SA-2: Allocation of Resources
Determine the high-level information security and privacy requirements for the system or system service in mission and business process planning; Determine, document, and allocate the resources required to protect the system or system service as part of the organizational capital planning and investment control process; and Establish a discrete line item for information security and…
SA-3: System Development Life Cycle
Acquire, develop, and manage the system using [Assignment: organization-defined system-development life cycle] that incorporates information security and privacy considerations; Define and document information security and privacy roles and responsibilities throughout the system development life cycle; Identify individuals having information security and privacy roles and responsibilities; and Integrate the organizational information security and privacy risk management…
Cloud Controls Matrix v4.0
AIS-04: Secure Application Design and Development
Define and implement a SDLC process for application design, development, deployment, and operation in accordance with security requirements defined by the organization.
AIS-06: Automated Secure Application Deployment
Establish and implement strategies and capabilities for secure, standardized, and compliant application deployment. Automate where possible.
DSP-01: Security and Privacy Policy and Procedures
Establish, document, approve, communicate, apply, evaluate and maintain policies and procedures for the classification, protection and handling of data throughout its lifecycle, and according to all applicable laws and regulations, standards, and risk level. Review and update the policies and procedures at least annually.
DSP-07: Data Protection by Design and Default
Develop systems, products, and business practices based upon a principle of security by design and industry best practices.
DSP-08: Data Privacy by Design and Default
Develop systems, products, and business practices based upon a principle of privacy by design and industry best practices. Ensure that systems' privacy settings are configured by default, according to all applicable laws and regulations.
NIST Special Publication 800-53 Revision 4
PM-3: Information Security Resources
The organization: Ensures that all capital planning and investment requests include the resources needed to implement the information security program and documents all exceptions to this requirement; Employs a business case/Exhibit 300/Exhibit 53 to record the resources required; and Ensures that information security resources are available for expenditure as planned.
SA-2: Allocation Of Resources
The organization: Determines information security requirements for the information system or information system service in mission/business process planning; Determines, documents, and allocates the resources required to protect the information system or information system service as part of its capital planning and investment control process; and Establishes a discrete line item for information security in organizational…
SA-3: System Development Life Cycle
The organization: Manages the information system using [Assignment: organization-defined system development life cycle] that incorporates information security considerations; Defines and documents information security roles and responsibilities throughout the system development life cycle; Identifies individuals having information security roles and responsibilities; and Integrates the organizational information security risk management process into system development life cycle activities.