Assessment Objective

Determine if:

• IR-04(07)[01] an incident handling capability is coordinated for insider threats;
• IR-04(07)[02] the coordinated incident handling capability includes [Assignment: entities].

Assessment Methods

Examine

• Incident response policy
• procedures addressing incident handling
• incident response plan
• insider threat program plan
• insider threat CONOPS
• system security plan
• privacy plan
• other relevant documents or records

Interview

• Organizational personnel with incident handling responsibilities
• organizational personnel with information security and privacy responsibilities
• organizational personnel/elements with whom the incident handling capability is to be coordinated

Test

• Organizational processes for coordinating incident handling

Susietos užduotys

• NIST -

  https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final