Assessment Objective
Determine if:
- IR-05[01] incidents are tracked;
- IR-05[02] incidents are documented.
Assessment Methods
Examine
- Incident response policy
- procedures addressing incident monitoring
- incident response records and documentation
- incident response plan
- system security plan
- privacy plan
- other relevant documents or records
Interview
- Organizational personnel with incident monitoring responsibilities
- organizational personnel with information security and privacy responsibilities
Test
- Incident monitoring capability for the organization
- mechanisms supporting and/or implementing the tracking and documenting of system security incidents
Linked Issues
| Linktype | Issue |
|---|---|
| blocks | IR-05 [H] Incident Monitoring |