Compliance Process
Imagine that you are part of a cross-functional product development team that includes researchers, software engineers, user experience designers, product managers, as well as the team's government counterparts. Your team is building a completely new digital service for a federal agency. The agency requires that your team produce a Security Impact Analysis (SIA) whenever changes that affect your product's security posture are introduced and has given you freedom to design the process.
Your task
As the security and compliance expert on your team, you have been asked to design a process the team can follow for completing a Security Impact Analysis (SIA) when required. This process should give your team members the information they need to determine when and how to complete an SIA.
Review the paragraph below, excerpted from section CM-4 in this document. It describes the requirements for an SIA.
Control: Analyze changes to the system to determine potential security and privacy impacts prior to change implementation.
Discussion: Organizational personnel with security or privacy responsibilities conduct impact analyses. Individuals conducting impact analyses possess the necessary skills and technical expertise to analyze the changes to systems as well as the security or privacy ramifications. Impact analyses include reviewing security and privacy plans, policies, and procedures to understand control requirements; reviewing system design documentation and operational procedures to understand control implementation and how specific system changes might affect the controls; reviewing the impact of changes on organizational supply chain partners with stakeholders; and determining how potential changes to a system create new risks to the privacy of individuals and the ability of implemented controls to mitigate those risks. Impact analyses also include risk assessments to understand the impact of the changes and determine if additional controls are required.
Goal
Design and document an SIA process for your team that addresses the CM-4 control.
Audience
Your cross-functional product development team --- including product, research, ux and engineering contributors --- is your primary audience.
Submission
- Answer in 2,000 or fewer words.
- Please do not identify yourself in your document.
- Save as a single plaintext (.txt) or markdown (.md) file.
Included files
Sample_Solution.md - this is an oversimplified example of the kind of document we're looking for in this assignment.
Ready to submit?
Don't include anything in your files that could identify you. We assign submissions a random number when they are received so our team does not know whose homework they are evaluating. Multiple team members will review your submission before a decision is made.