Assessment Objective
Determine if:
- SI-02(07) Determine if:
- SI-02(07)a. Root cause analysis is conducted to identify underlying causes of issues or failures
- SI-02(07)b. Actions to address the root cause of the issue of failure are developed
- SI-02(07)c.
- SI-02(07)c.[01] The actions (defined in [SI-02(07)b.](#si-2.7_smt.b)) are implemented
- SI-02(07)c.[02] The implementation of actions is monitored for effectiveness.
Assessment Methods
Examine
- System and information integrity policy;
- system and information integrity procedures;
- procedures addressing flaw remediation;
- procedures addressing root cause analysis/process improvement;
- system design documentation;
- system configuration settings and associated documentation;
- system audit records;
- system security and privacy plan;
- other relevant documents or records
Interview
- System/network administrators;
- organizational personnel with information security and privacy responsibilities;
- organizational personnel responsible for installing, configuring, and/or maintaining the system;
- organizational personnel responsible for flaw remediation;
- organizational personnel with configuration management responsibilities
Test
- Organizational processes for identifying, reporting, and correcting system flaws;
- organizational process for installing software and firmware updates;
- mechanisms supporting and/or implementing the reporting and correcting of system flaws;
- mechanisms supporting and/or implementing testing software and firmware updates
Saincheisteanna nasctha
| Cineál naisc | Saincheist |
|---|---|
| blocks | SI-02(07) Root Cause Analysis |