Assessment Objective
Determine if:
- IR-06(02) system vulnerabilities associated with reported incidents are reported to [Assignment: personnel or roles].
Assessment Methods
Examine
- Incident response policy
- procedures addressing incident reporting
- incident response plan
- system security plan
- privacy plan
- security incident reports and associated system vulnerabilities
- other relevant documents or records
Interview
- Organizational personnel with incident reporting responsibilities
- organizational personnel with information security and privacy responsibilities
- system/network administrators
- personnel to whom vulnerabilities associated with security incidents are to be reported
Test
- Organizational processes for incident reporting
- mechanisms supporting and/or implementing the reporting of vulnerabilities associated with security incidents
Linkede sager
| Linktype | Sag |
|---|---|
| blocks | IR-06(02) Vulnerabilities Related to Incidents |