Assessment Objective
Determine if:
- IR-04(11)[01] an integrated incident response team is established and maintained;
- IR-04(11)[02] the integrated incident response team can be deployed to any location identified by the organization in [Assignment: time period].
Assessment Methods
Examine
- Incident response policy
- procedures addressing incident handling
- procedures addressing incident response planning
- incident response plan
- system security plan
- privacy plan
- other relevant documents or records
Interview
- Organizational personnel with incident handling responsibilities
- organizational personnel with information security and privacy responsibilities
- members of the integrated incident response team
Verknüpfte Vorgänge
| Verknüpfungstyp | Vorgang |
|---|---|
| blocks | IR-04(11) [H] Integrated Incident Response Team |