Assessment Objective
Determine if:
- CA-08(03) the penetration testing process includes [Assignment: frequency] [Selection (one or more): announced; unannounced] attempts to bypass or circumvent controls associated with physical access points to facility.
Assessment Methods
Examine
- Assessment, authorization, and monitoring policy
- procedures addressing penetration testing
- procedures addressing red team exercises
- assessment plan
- results of red team exercises
- penetration test report
- assessment report
- rules of engagement
- assessment evidence
- system security plan
- privacy plan
- other relevant documents or records
Interview
- Organizational personnel with assessment responsibilities
- organizational personnel with information security and privacy responsibilities
- system/network administrators
Test
- Automated mechanisms supporting the employment of red team exercises
Ticket collegati
| Tipo di collegamento | Ticket |
|---|---|
| blocks | CA-08(03) Facility Penetration Testing |