PI1.1
Points of Focus
Identifies Information Specifications
The entity identifies information specifications required to support the use of products and services.
Defines Data Necessary to Support a Product or Service
When data is provided as part of a service or product or as part of a reporting obligation related to a product or service: (1) The definition and purpose of the data is available to the users of the data (2) The definition of the data includes the following information: a. The population of events or instances included in the set pf data b. The nature of each element (for example, field) of the set of data (that is, the event or instance to which the data element relates, for example, transaction price of a sale of XYZ Corporation stock for the last trade in that stock on a given day) c. The sources of the data within the set d. The units of measurement of data elements (for example, fields) e. The accuracy, correctness, or precision of measurement f. The uncertainty or confidence interval inherent in each data element and in the population of those elements g. The time periods over which the set of data was measured or the period of time during which the events the data relates to occurred h. In addition to the date or period of time, the factors that determined the inclusion and exclusion of items in the data elements and population (3) The definition of the data is complete and accurate. (4) The description of the data identifies any information that is necessary to understand each data element and the population in a manner consistent with its definition and intended purpose (metadata) that has not been included within the data.
[only for a system that produces, manufactures, or distributes products]
Defines Information Necessary to Support the Use of a Good or Product: When information provided by the entity is needed to use the good or product in accord-ance with its specifications: 1. The required information is available to the user of the good or product. 2. The required information is clearly identifiable. 3. The required information is validated for completeness and accuracy.
Evidence Requests
| Area of Focus | Artifact | Description |
|---|---|---|
| Resource Management | Secure Development Lifecycle (SDLC) | Documented evidence of a secure development lifecycle that the organization utilizes for new initiatives or significant changes to existing initiatives to ensure cybersecurity & data privacy principles are identified and implemented by default. |
| Privacy | Data Protection Impact Assessment (DPIA) | Documented evidence of Data Protection Impact Assessment (DPIA). |
| Third-Party Management | Service Level Agreements (SLAs) | Documented evidence of third-party Service Level Agreements (SLAs) to support business operations. |
| Technology Design & Acquisition | Secure Engineering Principles (SEP) | Documented evidence of defined secure engineering principles used to ensure Sensitivity, Integrity, Availability & Safety (CIAS) concerns are properly addressed in the design and implementation of systems, applications and services. |
| Technology Design & Acquisition | Software Assurance Maturity Model (SAMM) | Documented evidence of a Software Assurance Maturity Model (SAMM). |
| Business Continuity | Continuity of Operations Plan (COOP) Criticality Analysis | Documented evidence of a COOP-related criticality analysis. |
| Change Management | Business Impact Analysis (BIA) | Documented evidence of a Business Impact Analysis (BIA) for proposed changes. |
| Third-Party Management | Third-Party Criticality Assessment | Documented evidence of third-party criticality assessment that evaluates the critical nature of each third-party the organization works with. |