Assessment Objective

Determine if:

• SI-02a.
  • SI-02a.[01] system flaws are identified;
  • SI-02a.[02] system flaws are reported;
  • SI-02a.[03] system flaws are corrected;
• SI-02b.
  • SI-02b.[01] software updates related to flaw remediation are tested for effectiveness before installation;
  • SI-02b.[02] software updates related to flaw remediation are tested for potential side effects before installation;
  • SI-02b.[03] firmware updates related to flaw remediation are tested for effectiveness before installation;
  • SI-02b.[04] firmware updates related to flaw remediation are tested for potential side effects before installation;
• SI-02c.
  • SI-02c.[01] security-relevant software updates are installed within [Assignment: time period] of the release of the updates;
  • SI-02c.[02] security-relevant firmware updates are installed within [Assignment: time period] of the release of the updates;
• SI-02d. flaw remediation is incorporated into the organizational configuration management process.

Assessment Methods

Examine

• System and information integrity policy
• system and information integrity procedures
• procedures addressing flaw remediation
• procedures addressing configuration management
• list of flaws and vulnerabilities potentially affecting the system
• list of recent security flaw remediation actions performed on the system (e.g., list of installed patches, service packs, hot fixes, and other software updates to correct system flaws)
• test results from the installation of software and firmware updates to correct system flaws
• installation/change control records for security-relevant software and firmware updates
• system security plan
• privacy plan
• other relevant documents or records

Interview

• System/network administrators
• organizational personnel with information security and privacy responsibilities
• organizational personnel responsible for installing, configuring, and/or maintaining the system
• organizational personnel responsible for flaw remediation
• organizational personnel with configuration management responsibilities

Test

• Organizational processes for identifying, reporting, and correcting system flaws
• organizational process for installing software and firmware updates
• mechanisms supporting and/or implementing the reporting and correcting of system flaws
• mechanisms supporting and/or implementing testing software and firmware updates

Kwistjonijiet marbuta

• NIST -

  https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final