Assessment Objective

Determine if:

• incident response training for system users consistent with assigned roles and responsibilities is provided within [Assignment: time period] of assuming an incident response role or responsibility or acquiring system access.
• incident response training for system users consistent with assigned roles and responsibilities is provided when required by system changes.
• incident response training for system users consistent with assigned roles and responsibilities is provided [Assignment: frequency] thereafter.
• incident response training content is updated following [Assignment: events].
• incident response training content is updated [Assignment: frequency].
• incident response training content is reviewed following [Assignment: events].
• incident response training content is reviewed [Assignment: frequency].

Assessment Methods

Examine

• incident response policy and procedures
• procedures for incident response training
• incident response training curriculum
• incident response training materials
• incident response plan
• incident response training records
• system security plan
• other relevant documents or records

Interview

• personnel with incident response training and operational responsibilities
• personnel with information security responsibilities

Linked Issues

• NIST -

  https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final