Assessment Objective
Determine if:
- IR-08a.
- IR-08a.01 an incident response plan is developed that provides the organization with a roadmap for implementing its incident response capability;
- IR-08a.02 an incident response plan is developed that describes the structure and organization of the incident response capability;
- IR-08a.03 an incident response plan is developed that provides a high-level approach for how the incident response capability fits into the overall organization;
- IR-08a.04 an incident response plan is developed that meets the unique requirements of the organization with regard to mission, size, structure, and functions;
- IR-08a.05 an incident response plan is developed that defines reportable incidents;
- IR-08a.06 an incident response plan is developed that provides metrics for measuring the incident response capability within the organization;
- IR-08a.07 an incident response plan is developed that defines the resources and management support needed to effectively maintain and mature an incident response capability;
- IR-08a.08 an incident response plan is developed that addresses the sharing of incident information;
- IR-08a.09 an incident response plan is developed that is reviewed and approved by [Assignment: personnel or roles] [Assignment: frequency];
- IR-08a.10 an incident response plan is developed that explicitly designates responsibility for incident response to [Assignment: entities, personnel, or roles].
- IR-08b.
- IR-08b.[01] copies of the incident response plan are distributed to [Assignment: incident response personnel];
- IR-08b.[02] copies of the incident response plan are distributed to [Assignment: organizational elements];
- IR-08c. the incident response plan is updated to address system and organizational changes or problems encountered during plan implementation, execution, or testing;
- IR-08d.
- IR-08d.[01] incident response plan changes are communicated to [Assignment: incident response personnel];
- IR-08d.[02] incident response plan changes are communicated to [Assignment: organizational elements];
- IR-08e.
- IR-08e.[01] the incident response plan is protected from unauthorized disclosure;
- IR-08e.[02] the incident response plan is protected from unauthorized modification.
Assessment Methods
Examine
- Incident response policy
- procedures addressing incident response planning
- incident response plan
- system security plan
- privacy plan
- records of incident response plan reviews and approvals
- other relevant documents or records
Interview
- Organizational personnel with incident response planning responsibilities
- organizational personnel with information security and privacy responsibilities
Test
- Organizational incident response plan and related organizational processes
Linked Issues
| Linktype | Issue |
|---|---|
| blocks | IR-08 [L] Incident Response Plan |