03.11.08E Dynamic Threat Awareness

Statement

Determine the current cyber threat environment on an ongoing basis using {{ insert: param, A.03.11.08E.ODP.01 }}.

Guidance

The threat awareness information that is gathered feeds into the organization’s security operations to ensure that procedures are updated in response to the changing threat environment. For example, at higher threat levels, organizations may change the privilege or authentication thresholds required to perform certain operations. This requirement enhances SP 800-171 requirement 03.11.01.

Statement

• (includes detect and reveal) Reduce risk due to ignorance of threat events and possible replicated or similar threat events in the same or similar environments.

  • Reduce likelihood of impact.

  • The adversary loses the advantage of stealth as defenders are better prepared by developing and sharing threat intelligence.

Assessment objective

the current cyber threat environment is determined on an ongoing basis using {{ insert: param, A.03.11.08E.ODP.01 }}.

Assessment method

• Risk assessment policy security planning policy and procedures procedures addressing organizational assessments of risk risk assessment risk assessment results risk assessment reviews risk assessment updates risk reports system security plan other relevant documents or records

Assessment method

• Personnel with risk assessment responsibilities personnel with information security responsibilities

Assessment method

• Processes for risk assessment mechanisms supporting and/or conducting, documenting, reviewing, disseminating, and updating the risk assessment

1. Oversigt

1.1 Referencer

1.2 Identificerede krav

1.3 Relaterede reguleringer

2. Identificerede krav

3. Relaterede reguleringer

Linkede sager

• NIST -

  https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final