Differences
This shows you the differences between two versions of the page.
| Both sides previous revision Previous revision | |||
| public:99_annexes:annex-b-terms-and-definitions:s:sctm [2026/09/12 17:42] – ↷ Page moved from private:99_annexes:annex-b-terms-and-definitions:s:sctm to public:99_annexes:annex-b-terms-and-definitions:s:sctm nick_dido | public:99_annexes:annex-b-terms-and-definitions:s:sctm [2026/09/12 17:43] (current) – ↷ Links adapted because of a move operation nick_dido | ||
|---|---|---|---|
| Line 1: | Line 1: | ||
| ====== Security Control Traceability Matrix (SCTM) ====== | ====== Security Control Traceability Matrix (SCTM) ====== | ||
| - | [[private: | + | [[public: |
| ===== Discussion ===== | ===== Discussion ===== | ||
| Line 22: | Line 22: | ||
| * An identified risk | * An identified risk | ||
| * A remediation activity | * A remediation activity | ||
| - | * An [[private: | + | * An [[public: |
| * An Evidence Artifact | * An Evidence Artifact | ||
| * A configuration or deployment record | * A configuration or deployment record | ||
| - | * [[private: | + | * [[public: |
| - | * [[private: | + | * [[public: |
| The SCTM supports review of whether each identified security control has corresponding implementation and assessment information. | The SCTM supports review of whether each identified security control has corresponding implementation and assessment information. | ||
| Line 54: | Line 54: | ||
| An SCTM does not by itself establish that a control is implemented effectively. The matrix records traceable information that reviewers and assessors use when reaching that determination. | An SCTM does not by itself establish that a control is implemented effectively. The matrix records traceable information that reviewers and assessors use when reaching that determination. | ||
| - | An SCTM can support [[private: | + | An SCTM can support [[public: |
| ===== Example ===== | ===== Example ===== | ||