I have a question about the guidance in NIST 800-53.
The PM-1 controls in NIST 800-53 call for an information security plan. Does this plan typically include all of the organizations information security policies (common controls)? Could the information security plan be considered the information security policy?
Aucun commentaire:
Enregistrer un commentaire