Assessment Objective

Determine if:

• IR-05(01)[01] incidents are tracked using [Assignment: automated mechanisms];
• IR-05(01)[02] incident information is collected using [Assignment: automated mechanisms];
• IR-05(01)[03] incident information is analyzed using [Assignment: automated mechanisms].

Assessment Methods

Examine

• Incident response policy
• procedures addressing incident monitoring
• incident response records and documentation
• system security plan
• incident response plan
• other relevant documents or records

Interview

• Organizational personnel with incident monitoring responsibilities
• organizational personnel with information security responsibilities

Test

• Incident monitoring capability for the organization
• automated mechanisms supporting and/or implementing the tracking and documenting of system security incidents

Ticket collegati

• NIST -

  https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final