Offloading
LOW MODERATE HIGHRequirements NIST SOURCE
Offload [non-essential functions or services] to other systems, system components, or an external provider.
Discussion (NIST Supplemental Guidance)
Not every function or service that a system provides is essential to organizational mission or business functions. Printing or copying is an example of a non-essential but supporting service for an organization. Whenever feasible, such supportive but non-essential functions or services are not co-located with the functions or services that support essential mission or business functions. Maintaining such functions on the same system or system component increases the attack surface of the organization’s mission-essential functions or services. Moving supportive but non-essential functions to a non-critical system, system component, or external provider can also increase efficiency by putting those functions or services under the control of individuals or providers who are subject matter experts in the functions or services.
Implementation Guidance
Original engineering commentary written for this explorer — not NIST source text and not authoritative guidance.
No engineering interpretation has been authored for PM-7(1) yet. This section is architected to receive it — see the Requirements and Assessment sections above for the authoritative NIST source content in the meantime.
Assessment
Assessment Objectives
- non-essential functions or services to be offloaded are defined;
- <PM-07(01)_ODP non-essential functions or services> are offloaded to other systems, system components, or an external provider.
Examine
[SELECT FROM: Information security program plan; privacy program plan; enterprise architecture documentation; procedures addressing enterprise architecture development; procedures for identifying and offloading functions or services; results of risk assessments of enterprise architecture; other relevant documents or records].
Interview
[SELECT FROM: Organizational personnel with information security and privacy program planning and plan implementation responsibilities; organizational personnel responsible for developing enterprise architecture; organizational personnel responsible for risk assessments of enterprise architecture; organizational personnel with information security and privacy responsibilities].
Test
[SELECT FROM: Organizational processes for enterprise architecture development; mechanisms supporting the enterprise architecture and its development; mechanisms for offloading functions and services].
Overlays
STIGs & CCIs
No STIG checks or CCI mappings are currently loaded for PM-7(1). This section is architected to display, per product: STIG ID, Finding ID, Severity, Title, Description, Check, Fix, CCI, and NIST control mapping — but nothing is populated here until a real DISA STIG/CCI dataset is ingested.
Learn more about STIG/CCI integration →Evidence
Categorized from the SP 800-53A "Examine"/"Test" artifact list above by keyword — not an authoritative NIST evidence list.
Policy
- Information security program plan
- privacy program plan
Configuration
- enterprise architecture documentation
- procedures addressing enterprise architecture development
- results of risk assessments of enterprise architecture
Testing
- Organizational processes for enterprise architecture development
- mechanisms supporting the enterprise architecture and its development
- mechanisms for offloading functions and services
Other Records
- procedures for identifying and offloading functions or services
- other relevant documents or records