03.11.04 Risk Response

Statement

Respond to findings from security assessments, monitoring, and audits.

Guidance

This requirement addresses the need to determine an appropriate response to risk before generating a plan of action and milestones (POAM) entry. It may be possible to mitigate the risk immediately so that a POAM entry is not needed. However, a POAM entry is generated if the risk response is to mitigate the identified risk and the mitigation cannot be completed immediately.

Assessment objective

findings from security assessments are responded to.

Assessment objective

findings from security monitoring are responded to.

Assessment objective

findings from security audits are responded to.

Assessment method

• risk assessment policy assessment reports system audit records event logs system security plan other relevant documents or records

Assessment method

• personnel with assessment and auditing responsibilities system administrators personnel with security responsibilities

Assessment method

• processes for assessments and audits mechanisms and tools supporting or implementing assessments and auditing

1. Přehled

1.1 Odkazy

1.2 Identifikované požadavky

1.3 Související regulace

2. Identifikované požadavky

3. Související regulace

Propojené úkoly

• NIST -

  https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final