Assessment Objective
Determine if:
- IR-04a.
- IR-04a.[01] an incident handling capability for incidents is implemented that is consistent with the incident response plan;
- IR-04a.[02] the incident handling capability for incidents includes preparation;
- IR-04a.[03] the incident handling capability for incidents includes detection and analysis;
- IR-04a.[04] the incident handling capability for incidents includes containment;
- IR-04a.[05] the incident handling capability for incidents includes eradication;
- IR-04a.[06] the incident handling capability for incidents includes recovery;
- IR-04b. incident handling activities are coordinated with contingency planning activities;
- IR-04c.
- IR-04c.[01] lessons learned from ongoing incident handling activities are incorporated into incident response procedures, training, and testing;
- IR-04c.[02] the changes resulting from the incorporated lessons learned are implemented accordingly;
- IR-04d.
- IR-04d.[01] the rigor of incident handling activities is comparable and predictable across the organization;
- IR-04d.[02] the intensity of incident handling activities is comparable and predictable across the organization;
- IR-04d.[03] the scope of incident handling activities is comparable and predictable across the organization;
- IR-04d.[04] the results of incident handling activities are comparable and predictable across the organization.
Assessment Methods
Examine
- Incident response policy
- contingency planning policy
- procedures addressing incident handling
- incident response plan
- contingency plan
- system security plan
- privacy plan
- other relevant documents or records
Interview
- Organizational personnel with incident handling responsibilities
- organizational personnel with contingency planning responsibilities
- organizational personnel with information security and privacy responsibilities
Test
- Incident handling capability for the organization
Länkade ärenden
| Länktyp | Ärende |
|---|---|
| blocks | IR-04 [M] Incident Handling |