Assessment Objective
Determine if:
- CA-08(02) [Assignment: red team exercises] are employed to simulate attempts by adversaries to compromise organizational systems in accordance with applicable rules of engagement.
Assessment Methods
Examine
- Assessment, authorization, and monitoring policy
- procedures addressing penetration testing
- procedures addressing red team exercises
- assessment plan
- results of red team exercises
- penetration test report
- assessment report
- rules of engagement
- assessment evidence
- system security plan
- privacy plan
- other relevant documents or records
Interview
- Organizational personnel with assessment responsibilities
- organizational personnel with information security and privacy responsibilities
- system/network administrators
Test
- Mechanisms supporting the employment of red team exercises
Linked Issues
| Linktype | Issue |
|---|---|
| blocks | CA-08(02) Red Team Exercises |