Assessment Objective
Determine if:
- IR-02a.
- IR-02a.01 incident response training is provided to system users consistent with assigned roles and responsibilities within [Assignment: time period] of assuming an incident response role or responsibility or acquiring system access;
- IR-02a.02 incident response training is provided to system users consistent with assigned roles and responsibilities when required by system changes;
- IR-02a.03 incident response training is provided to system users consistent with assigned roles and responsibilities [Assignment: frequency] thereafter;
- IR-02b.
- IR-02b.[01] incident response training content is reviewed and updated [Assignment: frequency];
- IR-02b.[02] incident response training content is reviewed and updated following [Assignment: events].
Assessment Methods
Examine
- Incident response policy
- procedures addressing incident response training
- incident response training curriculum
- incident response training materials
- privacy plan
- incident response plan
- incident response training records
- system security plan
- privacy plan
- other relevant documents or records
Interview
- Organizational personnel with incident response training and operational responsibilities
- organizational personnel with information security and privacy responsibilities
Linked Issues
| Linktype | Issue |
|---|---|
| blocks | IR-02 [H] Incident Response Training |