+IR-09 Information Spillage Response
---+IR-09(02) Training
---+IR-09(03) Post-spill Operations
---+IR-09(04) Exposure to Unauthorized Personnel

IR-09 Information Spillage Response

Control

Respond to information spills by:
  1. Assigning [Assignement: personnel or roles] with responsibility for responding to information spills;
  2. Identifying the specific information involved in the system contamination;
  3. Alerting [Assignement: personnel or roles] of the information spill using a method of communication not associated with the spill;
  4. Isolating the contaminated system or system component;
  5. Eradicating the information from the contaminated system or component;
  6. Identifying other systems or system components that may have been subsequently contaminated; and
  7. Performing the following additional actions: [Assignement: actions].

Discussion

Information spillage refers to instances where information is placed on systems that are not authorized to process such information. Information spills occur when information that is thought to be a certain classification or impact level is transmitted to a system and subsequently is determined to be of a higher classification or impact level. At that point, corrective action is required. The nature of the response is based on the classification or impact level of the spilled information, the security capabilities of the system, the specific nature of the contaminated storage media, and the access authorizations of individuals with authorized access to the contaminated system. The methods used to communicate information about the spill after the fact do not involve methods directly associated with the actual spill to minimize the risk of further spreading the contamination before such contamination is isolated and eradicated.

Assessment Objective

  1. [Assignement: personnel or roles] is/are assigned the responsibility to respond to information spills;
  2. the specific information involved in the system contamination is identified in response to information spills;
  3. [Assignement: personnel or roles] is/are alerted of the information spill using a method of communication not associated with the spill;
  4. the contaminated system or system component is isolated in response to information spills;
  5. the information is eradicated from the contaminated system or component in response to information spills;
  6. other systems or system components that may have been subsequently contaminated are identified in response to information spills;
  7. [Assignement: actions] are performed in response to information spills.

Assessment Method

Examine

Incident response policy procedures addressing information spillage incident response plan system security plan records of information spillage alerts/notifications list of personnel who should receive alerts of information spillage list of actions to be performed regarding information spillage other relevant documents or records

Interview

Organizational personnel with incident response responsibilities organizational personnel with information security responsibilities

1. Oversigt

IR-09(02) Training

Control

Provide information spillage response training [Assignement: frequency].

Discussion

Organizations establish requirements for responding to information spillage incidents in incident response plans. Incident response training on a regular basis helps to ensure that organizational personnel understand their individual responsibilities and what specific actions to take when spillage incidents occur.

Assessment Objective

information spillage response training is provided [Assignement: frequency].

Assessment Method

Examine

Incident response policy procedures addressing information spillage response training information spillage response training curriculum information spillage response training materials incident response plan system security plan information spillage response training records other relevant documents or records

Interview

Organizational personnel with incident response training responsibilities organizational personnel with information security responsibilities
IR-09(03) Post-spill Operations

Control

Implement the following procedures to ensure that organizational personnel impacted by information spills can continue to carry out assigned tasks while contaminated systems are undergoing corrective actions: [Assignement: procedures].

Discussion

Corrective actions for systems contaminated due to information spillages may be time-consuming. Personnel may not have access to the contaminated systems while corrective actions are being taken, which may potentially affect their ability to conduct organizational business.

Assessment Objective

[Assignement: procedures] are implemented to ensure that organizational personnel impacted by information spills can continue to carry out assigned tasks while contaminated systems are undergoing corrective actions.

Assessment Method

Examine

Incident response policy procedures addressing incident response procedures addressing information spillage incident response plan system security plan other relevant documents or records

Interview

Organizational personnel with incident response responsibilities organizational personnel with information security responsibilities
IR-09(04) Exposure to Unauthorized Personnel

Control

Employ the following controls for personnel exposed to information not within assigned access authorizations: [Assignement: controls].

Discussion

Controls include ensuring that personnel who are exposed to spilled information are made aware of the laws, executive orders, directives, regulations, policies, standards, and guidelines regarding the information and the restrictions imposed based on exposure to such information.

Assessment Objective

[Assignement: controls] are employed for personnel exposed to information not within assigned access authorizations.

Assessment Method

Examine

Incident response policy procedures addressing incident response procedures addressing information spillage incident response plan system security plan security safeguards regarding information spillage/exposure to unauthorized personnel other relevant documents or records

Interview

Organizational personnel with incident response responsibilities organizational personnel with information security responsibilities

1.1 Referencer

1.2 Identificerede krav

1.3 Relaterede reguleringer

2. Identificerede krav

Krav

3. Relaterede reguleringer

Reguleringer

Linkede sager

Sagslinks
is blocked by IR-09 Information Spillage Response – Assessment Procedure
is blocked by Sensitive / Regulated Data Spill Response
is blocked by Sensitive / Regulated Data Spill Responsible Personnel
  • NIST -

    EN: Publications of the National Institute of Standards and Technology (NIST), U.S. Department of Commerce, https://www.nist.gov/, from their electronic versions (OSCAL; SP 800-63-4 from its HTML version, https://pages.nist.gov/800-63-4/). Works of NIST employees are not subject to copyright protection in the United States (17 U.S.C. § 105); the OSCAL content is dedicated to the public domain worldwide (CC0 1.0); outside the United States NIST grants the right to reprint its technical series publications in all formats (NIST copyright statement). Republished courtesy of the National Institute of Standards and Technology; each document names its citation. Divided into sections and converted into the GRCA format, the wording unchanged. Only the versions published by NIST are authoritative.

    DE: Veröffentlichungen des National Institute of Standards and Technology (NIST), U.S. Department of Commerce, https://www.nist.gov/, aus ihren elektronischen Fassungen (OSCAL; SP 800-63-4 aus ihrer HTML-Fassung, https://pages.nist.gov/800-63-4/). Werke von NIST-Beschäftigten sind in den USA urheberrechtlich nicht geschützt (17 U.S.C. § 105); die OSCAL-Inhalte sind weltweit gemeinfrei gestellt (CC0 1.0); außerhalb der USA räumt das NIST das Recht ein, seine Technical-Series-Publikationen in allen Formaten neu zu veröffentlichen (Copyright-Hinweis des NIST). „Republished courtesy of the National Institute of Standards and Technology“; jedes Dokument nennt seine Zitierangabe. In Abschnitte aufgeteilt und in das GRCA-Format umgewandelt, der Wortlaut unverändert. Maßgeblich sind allein die vom NIST veröffentlichten Fassungen.