+SA-15(10) Incident Response Plan
|
SA-15(10) Incident Response Plan
Control
Require the developer of the system, system component, or system service to provide, implement, and test an incident response plan.
Discussion
The incident response plan provided by developers may provide information not readily available to organizations and be incorporated into organizational incident response plans. Developer information may also be extremely helpful, such as when organizations respond to vulnerabilities in commercial off-the-shelf products.
Assessment Objective
- the developer of the system, system component, or system service is required to provide an incident response plan;
- the developer of the system, system component, or system service is required to implement an incident response plan;
- the developer of the system, system component, or system service is required to test an incident response plan.
Assessment Method
Examine
System and services acquisition policy
procedures addressing incident response, standards, and tools
solicitation documentation
acquisition documentation
service level agreements
acquisition contracts for the system, system components or services
acquisition documentation
solicitation documentation
service level agreements
developer incident response plan
system security plan
privacy plan
supply chain risk management plan
other relevant documents or records
Interview
Organizational personnel with system and service acquisition responsibilities
organizational personnel with information security responsibilities
system developer
organizational personnel with supply chain risk management responsibilities
1. Übersicht
1.1 Referenzen
1.2 Identifizierte Anforderungen
1.3 Zugehörige Regulierungen
2. Identifizierte Anforderungen
Anforderungen
| Quelle |
Anforderung |
3. Zugehörige Regulierungen
Regulierungen
| Quelle |
Regulierung |
Verknüpfte Vorgänge
|