Assessment Objective

Determine if:

• IR-02a.
  • IR-02a.01 incident response training is provided to system users consistent with assigned roles and responsibilities within [Assignment: time period] of assuming an incident response role or responsibility or acquiring system access;
  • IR-02a.02 incident response training is provided to system users consistent with assigned roles and responsibilities when required by system changes;
  • IR-02a.03 incident response training is provided to system users consistent with assigned roles and responsibilities [Assignment: frequency] thereafter;
• IR-02b.
  • IR-02b.[01] incident response training content is reviewed and updated [Assignment: frequency];
  • IR-02b.[02] incident response training content is reviewed and updated following [Assignment: events].

Assessment Methods

Examine

• Incident response policy
• procedures addressing incident response training
• incident response training curriculum
• incident response training materials
• privacy plan
• incident response plan
• incident response training records
• system security plan
• privacy plan
• other relevant documents or records

Interview

• Organizational personnel with incident response training and operational responsibilities
• organizational personnel with information security and privacy responsibilities

Saincheisteanna nasctha

• NIST -

  https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final