Assessment Objective

Determine if:

• RA-05(05) privileged access authorization is implemented to [Assignment: system components] for [Assignment: vulnerability scanning activities].

Assessment Methods

Examine

• Risk assessment policy
• procedures addressing vulnerability scanning
• system design documentation
• system configuration settings and associated documentation
• list of system components for vulnerability scanning
• personnel access authorization list
• authorization credentials
• access authorization records
• system security plan
• other relevant documents or records

Interview

• Organizational personnel with vulnerability scanning responsibilities
• system/network administrators
• organizational personnel responsible for access control to the system
• organizational personnel responsible for configuration management of the system
• system developers
• organizational personnel with security responsibilities

Test

• Organizational processes for vulnerability scanning
• organizational processes for access control
• mechanisms supporting and/or implementing access control
• mechanisms/tools supporting and/or implementing vulnerability scanning

Länkade ärenden

• NIST -

  https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final