Assessment Objectives

In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that:

• IRO-10_A01 incident response training for system users consistent with assigned roles and responsibilities is provided within an organization-defined time period of assuming an incident response role or responsibility or acquiring system access.
  Defined parameters: Ten (10) days for privileged users, thirty (30) days for Incident Response roles
  Assessment rigor: 1
  Origin: 53A_R5_IR-02a.01
• IRO-10_A02 events that initiate a review of the incident response training content are defined.
  Assessment rigor: 1
  Origin: 53A_R5_IR-02_ODP[04] 171A_R3_A.03.06.04.ODP[04]
• IRO-10_A03 incident response training content is updated per an organization-defined frequency.
  Defined parameters: at least annually
  Assessment rigor: 1
  Origin: SCF Created
• IRO-10_A04 incident response training content is reviewed / updated following organization-defined events.
  Defined parameters: at a minimum: following an incident requiring escalation, following an incident response test or exercise, and following material changes to systems, assigned roles or the threat environment
  Assessment rigor: 1
  Origin: SCF Created
• IRO-10_A05 the time period within which incident response training is to be provided to system users is defined.
  Defined parameters: ten (10) days for privileged users, thirty (30) days for Incident Response roles
  Assessment rigor: 2
  Origin: 53A_R5_IR-02_ODP[01] 171A_R3_A.03.06.04.ODP[01]
• IRO-10_A06 the frequency at which to provide incident response training to users after initial training is defined.
  Defined parameters: at least annually
  Assessment rigor: 2
  Origin: 53A_R5_IR-02_ODP[02] 171A_R3_A.03.06.04.ODP[02]
• IRO-10_A07 the frequency at which to review and update incident response training content is defined.
  Defined parameters: at least annually
  Assessment rigor: 2
  Origin: 53A_R5_IR-02_ODP[03] 171A_R3_A.03.06.04.ODP[03]
• IRO-10_A08 incident response training is provided to system users consistent with assigned roles and responsibilities when required by system changes.
  Assessment rigor: 3
  Origin: 53A_R5_IR-02a.02
• IRO-10_A09 incident response training is provided to system users consistent with assigned roles and responsibilities upon role assignment and per an organization-defined frequency thereafter.
  Defined parameters: at least annually
  Assessment rigor: 3
  Origin: 53A_R5_IR-02a.03
• IRO-10_A10 incident response training content is reviewed per an organization-defined frequency.
  Defined parameters: at least annually
  Assessment rigor: 3
  Origin: 53A_R5_IR-02b.[01]
• IRO-10_A11 incident response training content is reviewed / updated following events.
  Assessment rigor: 3
  Origin: 53A_R5_IR-02b.[02]
• IRO-10_A12 incident response training on how to identify and respond to a breach is provided.
  Assessment rigor: 3
  Origin: 53A_R5_IR-02(03)[01]
• IRO-10_A13 incident response training on the organization's process for reporting a breach is provided.
  Assessment rigor: 3
  Origin: 53A_R5_IR-02(03)[02]
• IRO-10_A14 incident response training for system users consistent with assigned roles and responsibilities is provided within <A.03.06.04.ODP[01]: time period> of assuming an incident response role or responsibility or acquiring system access.
  Defined parameters: ten (10) days for privileged users, thirty (30) days for all other roles
  Assessment rigor: NIST 800-171
  Origin: 171A_R3_A.03.06.04.a.01
• IRO-10_A15 incident response training content is reviewed <A.03.06.04.ODP[03]: frequency>.
  Defined parameters: at least every 12 months
  Assessment rigor: NIST 800-171
  Origin: 171A_R3_A.03.06.04.b[01]
• IRO-10_A16 incident response training content is updated <A.03.06.04.ODP[03]: frequency>.
  Defined parameters: at least every 12 months
  Assessment rigor: NIST 800-171
  Origin: 171A_R3_A.03.06.04.b[02]
• IRO-10_A17 incident response training content is reviewed following <A.03.06.04.ODP[04]: events>.
  Defined parameters: SDP values: (1) at least every 12 months (2) significant, novel incidents, or significant changes to risks
  Assessment rigor: NIST 800-171
  Origin: 171A_R3_A.03.06.04.b[03]
• IRO-10_A18 incident response training content is updated following <A.03.06.04.ODP[04]: events>.
  Defined parameters: SDP values: (1) at least every 12 months (2) significant, novel incidents, or significant changes to risks
  Assessment rigor: NIST 800-171
  Origin: 171A_R3_A.03.06.04.b[04]

Propojené úkoly

• Secure Controls Framework -

  EN: GRCA includes the Secure Controls Framework® (SCF) content, © Secure Controls Framework Council, LLC, used under the Creative Commons Attribution-NoDerivatives 4.0 International Public License. SCF control numbers, names, descriptions and mappings appear exactly as published by the SCF Council – https://securecontrolsframework.com. GRCA may group or reorder SCF content for display, which does not change SCF content; the mappings are shown as links to the frameworks they name. Learn more at https://securecontrolsframework.com.

  DE: GRCA enthält Inhalte des Secure Controls Framework® (SCF), © Secure Controls Framework Council, LLC, genutzt unter der Creative Commons Attribution-NoDerivatives 4.0 International Public License. Nummern, Namen, Beschreibungen und Zuordnungen der SCF-Controls erscheinen genau so, wie der SCF Council sie veröffentlicht – https://securecontrolsframework.com. GRCA gruppiert oder sortiert SCF-Inhalte für die Anzeige, ohne sie zu verändern; die Zuordnungen erscheinen als Verknüpfungen zu den genannten Regelwerken. Mehr unter https://securecontrolsframework.com.