Assessment Objective

Determine if:

• CA-08(02) [Assignment: red team exercises] are employed to simulate attempts by adversaries to compromise organizational systems in accordance with applicable rules of engagement.

Assessment Methods

Examine

• Assessment, authorization, and monitoring policy
• procedures addressing penetration testing
• procedures addressing red team exercises
• assessment plan
• results of red team exercises
• penetration test report
• assessment report
• rules of engagement
• assessment evidence
• system security plan
• privacy plan
• other relevant documents or records

Interview

• Organizational personnel with assessment responsibilities
• organizational personnel with information security and privacy responsibilities
• system/network administrators

Test

• Mechanisms supporting the employment of red team exercises

Incidencias vinculadas

• NIST -

  https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final