Assessment Objective

Determine if:

• PM-16(01) automated mechanisms are employed to maximize the effectiveness of sharing threat intelligence information.

Assessment Methods

Examine

• Information security program plan
• privacy program plan
• threat awareness program policy
• threat awareness program procedures
• risk assessment results related to threat awareness
• documentation about the cross-organization information-sharing capability
• other relevant documents or records

Interview

• Organizational personnel with information security and privacy program planning and plan implementation responsibilities
• organizational personnel responsible for the threat awareness program
• organizational personnel responsible for the cross-organization information-sharing capability
• organizational personnel with information security and privacy responsibilities
• external personnel with whom threat awareness information is shared by the organization

Test

• Organizational processes for implementing the threat awareness program
• organizational processes for implementing the cross-organization information-sharing capability
• automated mechanisms supporting and/or implementing the threat awareness program
• automated mechanisms supporting and/or implementing the cross-organization information-sharing capability

Powiązane zgłoszenia

• NIST -

  https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final