Assessment Objective
Determine if:
- IR-06a. personnel is/are required to report suspected incidents to the organizational incident response capability within [Assignment: time period];
- IR-06b. incident information is reported to [Assignment: authorities].
Assessment Methods
Examine
- Incident response policy
- procedures addressing incident reporting
- incident reporting records and documentation
- incident response plan
- system security plan
- privacy plan
- other relevant documents or records
Interview
- Organizational personnel with incident reporting responsibilities
- organizational personnel with information security and privacy responsibilities
- personnel who have/should have reported incidents
- personnel (authorities) to whom incident information is to be reported
- system users
Test
- Organizational processes for incident reporting
- mechanisms supporting and/or implementing incident reporting
Linked Issues
| Linktype | Issue |
|---|---|
| blocks | IR-06 [L] Incident Reporting |