Security Assessment
That controls are assessed, documented in an SSP, tracked via POA&Ms, and monitored continuously.
The 4 requirements, in plain language.
Periodically assess the security controls in organizational systems to determine if the controls are effective in their application
Develop and implement plans of action designed to correct deficiencies and reduce or eliminate vulnerabilities in organizational systems
Monitor security controls on an ongoing basis to ensure the continued effectiveness of the controls
Develop, document, and periodically update system security plans that describe system boundaries, system environments of operation, how security requirements are implemented, and the relationships with or connections to other systems
One owner across the whole family — built, run, and proven.
Enclave builds these controls into the boundary as code; Cadence keeps them enforced between assessments; Attest proves them to the C3PAO against every objective.
See all fourteen families →Not sure which families your contract puts in scope?
A readiness check maps your environment to all 110 controls and tells you exactly where you stand.