Assessment Objective
Determine if:
- RA-07[01] findings from security assessments are responded to in accordance with organizational risk tolerance;
- RA-07[02] findings from privacy assessments are responded to in accordance with organizational risk tolerance;
- RA-07[03] findings from monitoring are responded to in accordance with organizational risk tolerance;
- RA-07[04] findings from audits are responded to in accordance with organizational risk tolerance.
Assessment Methods
Examine
- Risk assessment policy
- assessment reports
- audit records/event logs
- system security plan
- privacy plan
- other relevant documents or records
Interview
- Organizational personnel with assessment and auditing responsibilities
- system/network administrators
- organizational personnel with security and privacy responsibilities
Test
- Organizational processes for assessments and audits
- mechanisms/tools supporting and/or implementing assessments and auditing
Linked Issues
| Linktype | Issue |
|---|---|
| blocks | RA-07 [H] Risk Response |