Assessment Objective
Determine if:
- RA-05(04)[01] information about the system is discoverable;
- RA-05(04)[02] [Assignment: corrective actions] are taken when information about the system is confirmed as discoverable.
Assessment Methods
Examine
- Procedures addressing vulnerability scanning
- assessment report
- penetration test results
- vulnerability scanning results
- risk assessment report
- records of corrective actions taken
- incident response records
- audit records
- system security plan
- other relevant documents or records
Interview
- Organizational personnel with vulnerability scanning and/or penetration testing responsibilities
- organizational personnel with vulnerability scan analysis responsibilities
- organizational personnel responsible for risk response
- organizational personnel responsible for incident management and response
- organizational personnel with security responsibilities
Test
- Organizational processes for vulnerability scanning
- organizational processes for risk response
- organizational processes for incident management and response
- mechanisms/tools supporting and/or implementing vulnerability scanning
- mechanisms supporting and/or implementing risk response
- mechanisms supporting and/or implementing incident management and response
Kwistjonijiet marbuta
| Tip ta’ link | Kwistjoni |
|---|---|
| blocks | RA-05(04) Discoverable Information |