Assessment Objective
Determine if:
- system security incidents are tracked.
- system security incidents are documented.
- suspected incidents are reported to the organizational incident response capability within [Assignment: time period].
- incident information is reported to [Assignment: authorities].
- an incident response support resource that offers advice and assistance to system users on handling and reporting incidents is provided.
Assessment Methods
Examine
- incident response policy and procedures
- procedures for incident monitoring
- procedures for incident response assistance
- incident response records and documentation
- incident response plan
- system security plan
- other relevant documents or records
Interview
- personnel with incident monitoring responsibilities
- personnel with incident response assistance and support responsibilities
- personnel with information security responsibilities
Test
- processes for incident reporting
- incident monitoring capability
- mechanisms for supporting or implementing the tracking and documenting of system security incidents
- mechanisms for supporting or implementing incident reporting
- mechanisms for supporting or implementing incident response assistance
- processes for incident response assistance
Linkede sager
| Linktype | Sag |
|---|---|
| blocks | 03.06.02 Incident Monitoring, Reporting, and Response Assistance |