Assessment Objective
Determine if:
- RA-05(08) historic audit logs are reviewed to determine if a vulnerability identified in a [Assignment: system] has been previously exploited within [Assignment: time period].
Assessment Methods
Examine
- Risk assessment policy
- procedures addressing vulnerability scanning
- audit logs
- records of audit log reviews
- vulnerability scanning results
- patch and vulnerability management records
- system security plan
- other relevant documents or records
Interview
- Organizational personnel with vulnerability scanning responsibilities
- organizational personnel with vulnerability scan analysis responsibilities
- organizational personnel with audit record review responsibilities
- system/network administrators
- organizational personnel with security responsibilities
Test
- Organizational processes for vulnerability scanning
- organizational process for audit record review and response
- mechanisms/tools supporting and/or implementing vulnerability scanning
- mechanisms supporting and/or implementing audit record review
Linked Issues
| Linktype | Issue |
|---|---|
| blocks | RA-05(08) Review Historic Audit Logs |