CM-4 SECURITY IMPACT ANALYSIS
Page last updated:
Impact analysis to determine potential security implications of system changes are the responsibility of the deployer. The operational consistency provided by PCF helps to reduce the impact analysis of any planned changes. The use of PCF as a hosting environment enables organizations to achieve consistency in application deployment processes, reducing the need for extensive, application-specific impact analysis prior to application changes or upgrades. Changes to the PCF foundation itself are performed by an operator using BOSH or Ops Manager, and these actions can be performed while applications remain available. Changes to application configuration are not expected to have any impact on the security posture of the PCF platform infrastructure. The application isolation guarantees provided by the PCF platform help to reduce the impact of any planned application changes, and reduce the scope of any required impact analysis.
The organization analyzes changes to the information system to determine potential security impacts prior to change implementation.
Organizational personnel with information security responsibilities (e.g., Information System Administrators, Information System Security Officers, Information System Security Managers, and Information System Security Engineers) conduct security impact analyses. Individuals conducting security impact analyses possess the necessary skills/technical expertise to analyze the changes to information systems and the associated security ramifications. Security impact analysis may include, for example, reviewing security plans to understand security control requirements and reviewing system design documentation to understand control implementation and how specific changes might affect the controls. Security impact analyses may also include assessments of risk to better understand the impact of the changes and to determine if additional security controls are required. Security impact analyses are scaled in accordance with the security categories of the information systems.