SFS D / SF E

Back to SFS D

Status: Question model review passed; solution and completed SF authoring pending.

This is a generated authoring draft. Human approval and operational assessment results have not been supplied.

Question

Has documented evidence been maintained throughout the review period confirming that designated management authorities regularly review operational security metrics to assess control effectiveness?

Plain-language explanation

Model-reviewed question draft. Completed explanations and a canonical solution are pending. The proposed positive criterion is: Documentation showing regular reviews with demonstrated assessment of control effectiveness

Assessment criterion and evidence

Actor: Designated management authorities. Scope: Organizational security performance metrics. Evidence period: Review period. Required evidence: Records of management review meetings; Documented security metrics with trend analysis; Evidence of follow-up actions based on assessments. Negative criterion: Documentation showing no reviews conducted or reviews without substantive assessment of metrics. Missing evidence: No evidence of management review activities provided

View the JSON record (opens in a new tab).

Assessment result: unset.