II.A.2.a: Assessment Aggregation

Aggregate program and system-level security and privacy assessments such as FIPS PUB 199 security characterizations and Privacy Impact Assessments.

Other Information:

* An agency with 100 systems may find that 50 are all subject to the Low/Low/Low security control baseline; another 25 may be subject to the High/High/Medium baseline; and the remaining 25 to an assortment of other combinations. * An agency may determine that 30 of their systems hold personally identifiable information subject to the Privacy Act, HIPAA, or other privacy law considerations.

Indicator(s):

Indicator:1

Content