+SI-07(07) [H] Integration of Detection and Response
|
SI-07(07) [H] Integration of Detection and Response
Control
Incorporate the detection of the following unauthorized changes into the organizational incident response capability: [Assignement: changes].
Discussion
Integrating detection and response helps to ensure that detected events are tracked, monitored, corrected, and available for historical purposes. Maintaining historical records is important for being able to identify and discern adversary actions over an extended time period and for possible legal actions. Security-relevant changes include unauthorized changes to established configuration settings or the unauthorized elevation of system privileges.
Assessment Objective
the detection of [Assignement: changes] are incorporated into the organizational incident response capability.
Assessment Method
Examine
System and information integrity policy
system and information integrity procedures
procedures addressing software, firmware, and information integrity
procedures addressing incident response
system design documentation
system configuration settings and associated documentation
incident response records
audit records
system security plan
other relevant documents or records
Interview
Organizational personnel responsible for software, firmware, and/or information integrity
organizational personnel with information security responsibilities
organizational personnel with incident response responsibilities
1. Pregled
1.1 Sklici
1.2 Ugotovljene zahteve
1.3 Povezani predpisi
2. Ugotovljene zahteve
3. Povezani predpisi
Povezane zadeve
|