Assessment Objectives
In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that:
- IRO-08_A01 personnel or roles that review and approve the incident response plan is/are identified.
Assessment rigor: 1
Origin: 53A_R5_IR-08_ODP[01] - IRO-08_A02 entities, personnel or roles with designated responsibility for incident response are defined.
Assessment rigor: 1
Origin: 53A_R5_IR-08_ODP[03] - IRO-08_A03 an incident response plan is developed that provides the organization with a roadmap for implementing its incident response capability.
Assessment rigor: 1
Origin: 53A_R5_IR-08a.01 171A_R3_A.03.06.05.a.01 - IRO-08_A04 an incident response plan is developed that describes the structure and organization of the incident response capability.
Assessment rigor: 1
Origin: 53A_R5_IR-08a.02 171A_R3_A.03.06.05.a.02 - IRO-08_A05 an incident response plan is developed that provides a high-level approach for how the incident response capability fits into the overall organization.
Assessment rigor: 1
Origin: 53A_R5_IR-08a.03 171A_R3_A.03.06.05.a.03 - IRO-08_A06 an incident response plan is developed that meets the unique requirements of the organization with regard to mission, size, structure and functions.
Assessment rigor: 1
Origin: 53A_R5_IR-08a.04 - IRO-08_A07 an incident response plan is developed that defines reportable incidents.
Assessment rigor: 1
Origin: 53A_R5_IR-08a.05 171A_R3_A.03.06.05.a.04 - IRO-08_A08 an incident response plan is developed that provides metrics for measuring the incident response capability within the organization.
Assessment rigor: 1
Origin: 53A_R5_IR-08a.06 - IRO-08_A09 an incident response plan is developed that defines the resources and management support needed to effectively maintain and mature an incident response capability.
Assessment rigor: 1
Origin: 53A_R5_IR-08a.07 - IRO-08_A10 an incident response plan is developed that addresses the sharing of incident information.
Assessment rigor: 1
Origin: 53A_R5_IR-08a.08 171A_R3_A.03.06.05.a.05 - IRO-08_A11 an incident response plan is developed that is reviewed and approved by personnel or roles frequency.
Defined parameters: at least annually
Assessment rigor: 1
Origin: 53A_R5_IR-08a.09 - IRO-08_A12 an incident response plan is developed that designates responsibilities to organizational entities, personnel, or roles.
Assessment rigor: 1
Origin: 53A_R5_IR-08a.10 171A_R3_A.03.06.05.a.06 - IRO-08_A13 copies of the incident response plan are distributed to designated incident response personnel (identified by name or by role).
Assessment rigor: 1
Origin: 53A_R5_IR-08b.[01] 171A_R3_A.03.06.05.b[01] - IRO-08_A14 incident response personnel (identified by name and/or by role) to whom copies of the incident response plan are to be distributed is/are defined.
Assessment rigor: 3
Origin: 53A_R5_IR-08_ODP[04] - IRO-08_A15 organizational elements to which copies of the incident response plan are to be distributed are defined.
Assessment rigor: 3
Origin: 53A_R5_IR-08_ODP[05] - IRO-08_A16 incident response personnel (identified by name and/or by role) to whom changes to the incident response plan is/are communicated are defined.
Assessment rigor: 3
Origin: 53A_R5_IR-08_ODP[06] - IRO-08_A17 organizational elements to which changes to the incident response plan are communicated are defined.
Assessment rigor: 3
Origin: 53A_R5_IR-08_ODP[07] - IRO-08_A18 copies of the incident response plan are distributed to organizational elements.
Assessment rigor: 2
Origin: 53A_R5_IR-08b.[02] 171A_R3_A.03.06.05.b[02] - IRO-08_A19 the frequency at which to review and approve the incident response plan is defined.
Defined parameters: at least annually
Assessment rigor: 3
Origin: 53A_R5_IR-08_ODP[02] - IRO-08_A20 the incident response plan is updated to address system and organizational changes or problems encountered during plan implementation, execution or testing.
Assessment rigor: 3
Origin: 53A_R5_IR-08c. - IRO-08_A21 incident response plan changes are communicated to incident response personnel.
Assessment rigor: 3
Origin: 53A_R5_IR-08d.[01] - IRO-08_A22 incident response plan changes are communicated to organizational elements.
Assessment rigor: 3
Origin: 53A_R5_IR-08d.[02] - IRO-08_A23 the incident response plan is protected from unauthorized disclosure.
Assessment rigor: 2
Origin: 53A_R5_IR-08e.[01] 171A_R3_A.03.06.05.d - IRO-08_A24 the incident response plan is protected from unauthorized modification.
Assessment rigor: 3
Origin: 53A_R5_IR-08e.[02] - IRO-08_A25 the time period to report suspected incidents to the organizational incident response capability is defined.
Assessment rigor: 2
Origin: 171A_R3_A.03.06.02.ODP[01] - IRO-08_A26 authorities to whom incident information is to be reported are defined.
Assessment rigor: 2
Origin: 171A_R3_A.03.06.02.ODP[02]
Kwistjonijiet marbuta
| Tip ta’ link | Kwistjoni |
|---|---|
| blocks | Incident Response Plan (IRP) |
- Secure Controls Framework -
EN: GRCA includes the Secure Controls Framework® (SCF) content, © Secure Controls Framework Council, LLC, used under the Creative Commons Attribution-NoDerivatives 4.0 International Public License. SCF control numbers, names, descriptions and mappings appear exactly as published by the SCF Council – https://securecontrolsframework.com. GRCA may group or reorder SCF content for display, which does not change SCF content; the mappings are shown as links to the frameworks they name. Learn more at https://securecontrolsframework.com.
DE: GRCA enthält Inhalte des Secure Controls Framework® (SCF), © Secure Controls Framework Council, LLC, genutzt unter der Creative Commons Attribution-NoDerivatives 4.0 International Public License. Nummern, Namen, Beschreibungen und Zuordnungen der SCF-Controls erscheinen genau so, wie der SCF Council sie veröffentlicht – https://securecontrolsframework.com. GRCA gruppiert oder sortiert SCF-Inhalte für die Anzeige, ohne sie zu verändern; die Zuordnungen erscheinen als Verknüpfungen zu den genannten Regelwerken. Mehr unter https://securecontrolsframework.com.