+SI-02(07) Root Cause Analysis
|
SI-02(07) Root Cause Analysis
Control
- Conduct root cause analysis to identify underlying causes of issues or failures.
- Develop actions to address the root cause of the issue or failure.
- Implement the actions and monitor the implementation for effectiveness.
Discussion
Root cause analysis includes a wide range of approaches, tools, and techniques to systematically identify the underlying cause of issues or failures to systems and systems components (hardware, software, and firmware). Organizations consider the severity of the incident to determine what root cause analysis method is used and how quickly implementation of the remediation actions. The root cause analysis includes a timeline, missed warning signs, key decisions, gaps, mitigations, and verification of effectiveness. The actions identified to address the source of the issue are implemented and integrated into applicable organizational policy, procedures, and control implementation.
Assessment Objective
Determine if:- Root cause analysis is conducted to identify underlying causes of issues or failures
- Actions to address the root cause of the issue of failure are developed
- The actions (defined in [SI-02(07)b.](#si-2.7_smt.b)) are implemented
- The implementation of actions is monitored for effectiveness.
Assessment Method
Examine
System and information integrity policy;
system and information integrity procedures;
procedures addressing flaw remediation;
procedures addressing root cause analysis/process improvement;
system design documentation;
system configuration settings and associated documentation;
system audit records;
system security and privacy plan;
other relevant documents or records
Interview
System/network administrators;
organizational personnel with information security and privacy responsibilities;
organizational personnel responsible for installing, configuring, and/or maintaining the system;
organizational personnel responsible for flaw remediation;
organizational personnel with configuration management responsibilities
1. Prezentare generală
1.1 Referințe
1.2 Cerințe identificate
1.3 Reglementări asociate
2. Cerințe identificate
3. Reglementări asociate
Reglementări
| Sursă |
Reglementare |
Tichete legate
|