Assessment Objective
Determine if:
- SA-15(10)[01] the developer of the system, system component, or system service is required to provide an incident response plan;
- SA-15(10)[02] the developer of the system, system component, or system service is required to implement an incident response plan;
- SA-15(10)[03] the developer of the system, system component, or system service is required to test an incident response plan.
Assessment Methods
Examine
- System and services acquisition policy
- procedures addressing incident response, standards, and tools
- solicitation documentation
- acquisition documentation
- service level agreements
- acquisition contracts for the system, system components or services
- acquisition documentation
- solicitation documentation
- service level agreements
- developer incident response plan
- system security plan
- privacy plan
- supply chain risk management plan
- other relevant documents or records
Interview
- Organizational personnel with system and service acquisition responsibilities
- organizational personnel with information security responsibilities
- system developer
- organizational personnel with supply chain risk management responsibilities
Gekoppelde issues
| Koppelingstype | Issue |
|---|---|
| blocks | SA-15(10) Incident Response Plan |