Assessment Objective
Determine if:
- RA-10a.
- RA-10a.01 a cyber threat capability is established and maintained to search for indicators of compromise in organizational systems;
- RA-10a.02 a cyber threat capability is established and maintained to detect, track, and disrupt threats that evade existing controls;
- RA-10b. the threat hunting capability is employed [Assignment: frequency].
Assessment Methods
Examine
- Risk assessment policy
- assessment reports
- audit records/event logs
- threat hunting capability
- system security plan
- other relevant documents or records
Interview
- Organizational personnel with threat hunting responsibilities
- system/network administrators
- organizational personnel with security responsibilities
Test
- Organizational processes for assessments and audits
- mechanisms/tools supporting and/or implementing threat hunting capabilities
Verknüpfte Vorgänge
| Verknüpfungstyp | Vorgang |
|---|---|
| blocks | RA-10 Threat Hunting |