Assessment Objective

Determine if:

• a system-level continuous monitoring strategy is developed.
• a system-level continuous monitoring strategy is implemented.
• ongoing monitoring is included in the continuous monitoring strategy.
• security assessments are included in the continuous monitoring strategy.

Assessment Methods

Examine

• security assessment and monitoring policy and procedures
• organizational continuous monitoring strategy
• system-level continuous monitoring strategy
• procedures for continuous monitoring of the system
• procedures for configuration management
• security assessment report
• plan of action and milestones
• system monitoring records
• configuration management records
• impact analyses
• status reports
• system security plan
• other relevant documents or records

Interview

• personnel with continuous monitoring responsibilities
• personnel with information security responsibilities
• system administrators

Test

• mechanisms for implementing continuous monitoring
• mechanisms for supporting response actions for assessment and monitoring results
• mechanisms for supporting security status reporting

Povezani zadaci

• NIST -

  https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final