Assessment Objective
Determine if:
- AU-13a. [Assignment: open-source information and/or information sites] is/are monitored [Assignment: frequency] for evidence of unauthorized disclosure of organizational information;
- AU-13b.
- AU-13b.01 [Assignment: personnel or roles] are notified if an information disclosure is discovered;
- AU-13b.02 [Assignment: additional actions] are taken if an information disclosure is discovered.
Assessment Methods
Examine
- Audit and accountability policy
- system security plan
- privacy plan
- procedures addressing information disclosure monitoring
- system design documentation
- system configuration settings and associated documentation
- monitoring records
- system audit records
- other relevant documents or records
Interview
- Organizational personnel with responsibilities for monitoring open-source information and/or information sites
- organizational personnel with security and privacy responsibilities
Test
- Mechanisms implementing monitoring for information disclosure
Prepojené úlohy
| Typ prepojenia | Úloha |
|---|---|
| blocks | AU-13 Monitoring for Information Disclosure |