Assessment Objective

Determine if:

• findings from security assessments are responded to.
• findings from security monitoring are responded to.
• findings from security audits are responded to.

Assessment Methods

Examine

• risk assessment policy
• assessment reports
• system audit records
• event logs
• system security plan
• other relevant documents or records

Interview

• personnel with assessment and auditing responsibilities
• system administrators
• personnel with security responsibilities

Test

• processes for assessments and audits
• mechanisms and tools supporting or implementing assessments and auditing

Linked Issues

• NIST -

  https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final