Assessment Objectives

In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that:

• IRO-26_A01 post-incident assurance activities (e.g., vulnerability scanning, configuration review, integrity verification and control testing) are performed on affected Technology Assets, Applications and Services (TAAS) before they are returned to normal business operations.
  Assessment rigor: 1
  Origin: SCF Created
• IRO-26_A02 post-incident assurance activities validate that affected Technology Assets, Applications and Services (TAAS) are secure, including that the exploited weakness has been remediated and no indicators of compromise remain.
  Assessment rigor: 2
  Origin: SCF Created
• IRO-26_A03 post-incident assurance activities validate that affected Technology Assets, Applications and Services (TAAS) are compliant with applicable security, compliance and resilience requirements.
  Assessment rigor: 2
  Origin: SCF Created
• IRO-26_A04 post-incident assurance activities validate that affected Technology Assets, Applications and Services (TAAS) are capable of supporting the resumption of normal business operations.
  Assessment rigor: 2
  Origin: SCF Created
• IRO-26_A05 the results of post-incident assurance activities, including the approval to return affected Technology Assets, Applications and Services (TAAS) to normal business operations, are documented and retained.
  Assessment rigor: 1
  Origin: SCF Created

Linked Issues

• Secure Controls Framework -

  EN: GRCA includes the Secure Controls Framework® (SCF) content, © Secure Controls Framework Council, LLC, used under the Creative Commons Attribution-NoDerivatives 4.0 International Public License. SCF control numbers, names, descriptions and mappings appear exactly as published by the SCF Council – https://securecontrolsframework.com. GRCA may group or reorder SCF content for display, which does not change SCF content; the mappings are shown as links to the frameworks they name. Learn more at https://securecontrolsframework.com.

  DE: GRCA enthält Inhalte des Secure Controls Framework® (SCF), © Secure Controls Framework Council, LLC, genutzt unter der Creative Commons Attribution-NoDerivatives 4.0 International Public License. Nummern, Namen, Beschreibungen und Zuordnungen der SCF-Controls erscheinen genau so, wie der SCF Council sie veröffentlicht – https://securecontrolsframework.com. GRCA gruppiert oder sortiert SCF-Inhalte für die Anzeige, ohne sie zu verändern; die Zuordnungen erscheinen als Verknüpfungen zu den genannten Regelwerken. Mehr unter https://securecontrolsframework.com.