+SI-02(03) Time to Remediate Flaws and Benchmarks for Corrective Actions
|
SI-02(03) Time to Remediate Flaws and Benchmarks for Corrective Actions
Control
- Measure the time between flaw identification and flaw remediation; and
- Establish the following benchmarks for taking corrective actions: [Assignement: benchmarks].
Discussion
Organizations determine the time it takes on average to correct system flaws after such flaws have been identified and subsequently establish organizational benchmarks (i.e., time frames) for taking corrective actions. Benchmarks can be established by the type of flaw or the severity of the potential vulnerability if the flaw can be exploited.
Assessment Objective
- the time between flaw identification and flaw remediation is measured;
- [Assignement: benchmarks] for taking corrective actions have been established.
Assessment Method
Examine
System and information integrity policy
system and information integrity procedures
procedures addressing flaw remediation
system design documentation
system configuration settings and associated documentation
list of benchmarks for taking corrective action on identified flaws
records that provide timestamps of flaw identification and subsequent flaw remediation activities
system security plan
other relevant documents or records
Interview
System/network administrators
organizational personnel with information security responsibilities
organizational personnel installing, configuring, and/or maintaining the system
organizational personnel responsible for flaw remediation
1. Panoramica
1.1 Riferimenti
1.2 Requisiti identificati
1.3 Regolamentazioni correlate
2. Requisiti identificati
Requisiti
| Fonte |
Requisito |
3. Regolamentazioni correlate
Regolamentazioni
| Fonte |
Regolamentazione |
Ticket collegati
|