Assessment Objective
Determine if:
- IR-03 the effectiveness of the incident response capability for the system is tested [Assignment: frequency] using [Assignment: tests].
Assessment Methods
Examine
- Incident response policy
- contingency planning policy
- procedures addressing incident response testing
- procedures addressing contingency plan testing
- incident response testing material
- incident response test results
- incident response test plan
- incident response plan
- contingency plan
- system security plan
- privacy plan
- other relevant documents or records
Interview
- Organizational personnel with incident response testing responsibilities
- organizational personnel with information security and privacy responsibilities
Linked Issues
| Linktype | Issue |
|---|---|
| blocks | IR-03 [M] Incident Response Testing |