Assessment Objective

Determine if:

• IR-04(15)(a) public relations associated with an incident are managed;
• IR-04(15)(b) measures are employed to repair the reputation of the organization.

Assessment Methods

Examine

• Incident response policy
• procedures addressing incident response
• procedures addressing incident handling
• incident response plan
• system security plan
• other relevant documents or records

Interview

• Organizational personnel with incident handling responsibilities
• organizational personnel with information security responsibilities
• organizational personnel with communications or public relations responsibilities

Ticket collegati

• NIST -

  https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final