Assessment Objective
Determine if:
- IR-04(14)[01] a security operations center is established;
- IR-04(14)[02] a security operations center is maintained.
Assessment Methods
Examine
- Incident response policy
- contingency planning policy
- procedures addressing incident handling
- procedures addressing the security operations center operations
- mechanisms supporting dynamic response capabilities
- incident response plan
- contingency plan
- system security plan
- other relevant documents or records
Interview
- Organizational personnel with incident handling responsibilities
- organizational personnel with contingency planning responsibilities
- security operations center personnel
- organizational personnel with information security responsibilities
Test
- Mechanisms that support and/or implement the security operations center capability
- mechanisms that support and/or implement the incident handling process
Verknüpfte Vorgänge
| Verknüpfungstyp | Vorgang |
|---|---|
| blocks | IR-04(14) Security Operations Center |