Assessment Objective
Determine if:
- RA-05(11) a public reporting channel is established for receiving reports of vulnerabilities in organizational systems and system components.
Assessment Methods
Examine
- Risk assessment policy
- procedures addressing vulnerability scanning
- risk assessment
- vulnerability scanning tools and techniques documentation
- vulnerability scanning results
- vulnerability management records
- audit records
- public reporting channel
- system security plan
- other relevant documents or records
Interview
- Organizational personnel with vulnerability scanning responsibilities
- organizational personnel with vulnerability scan analysis responsibilities
- organizational personnel with security responsibilities
Test
- Organizational processes for vulnerability scanning
- mechanisms/tools supporting and/or implementing vulnerability scanning
- mechanisms implementing the public reporting of vulnerabilities
Linkede sager
| Linktype | Sag |
|---|---|
| blocks | RA-05(11) [H] Public Disclosure Program |