Assessment Objective

Determine if:

• an incident-handling capability that is consistent with the incident response plan is implemented.
• the incident handling capability includes preparation.
• the incident handling capability includes detection and analysis.
• the incident handling capability includes containment.
• the incident handling capability includes eradication.
• the incident handling capability includes recovery.

Assessment Methods

Examine

• incident response policy and procedures
• contingency planning policy and procedures
• procedures for incident handling
• procedures for incident response planning
• incident response plan
• contingency plan
• records of incident response plan reviews and approvals
• system security plan
• other relevant documents or records

Interview

• personnel with incident handling responsibilities
• personnel with incident response planning responsibilities
• personnel with contingency planning responsibilities
• personnel with information security responsibilities

Test

• incident handling capability for the organization
• incident response plan

Propojené úkoly

• NIST -

  https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final