Assessment Objective

Determine if:

• discoverable information about the system is identified.
• [Assignment: corrective actions] are taken when information about the system is confirmed as discoverable.

Assessment Methods

Examine

• Procedures addressing vulnerability scanning
• assessment report
• penetration test results
• vulnerability scanning results
• risk assessment report
• records of corrective actions taken on discoverable information
• incident response records
• audit records
• system security plan
• other relevant documents or records

Interview

• Personnel with vulnerability scanning and/or penetration testing responsibilities
• personnel with vulnerability scan analysis responsibilities
• personnel responsible for risk response
• personnel responsible for incident management and response
• personnel with information security responsibilities

Test

• Processes for vulnerability scanning
• processes for risk response
• processes for incident management and response
• mechanisms and/or tools supporting and/or implementing vulnerability scanning
• mechanisms supporting and/or implementing risk response
• mechanisms supporting and/or implementing incident management and response

Gekoppelde issues

• NIST -

  https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final