Evidence Collection Approach - Revision history

David: /* System and Information Integrity (SI) */

2025-03-30T19:35:31Z

System and Information Integrity (SI)

David: /* System and Communications Protection (SC) */

2025-03-30T19:31:07Z

System and Communications Protection (SC)

Show changes

David: /* Security Assessment (CA) */

2025-03-30T19:21:20Z

Security Assessment (CA)

David: /* Risk Assessment (RA) */

2025-03-30T19:17:23Z

Risk Assessment (RA)

David: /* Physical Protection (PE) */

2025-03-30T19:14:57Z

Physical Protection (PE)

David: /* Personnel Security (PS) */

2025-03-30T19:08:16Z

Personnel Security (PS)

← Older revision		Revision as of 19:08, 30 March 2025
Line 1,110:		Line 1,110:
	\| colspan="3" \| [[Practice_PS.L2-3.9.1_Details\|'''PS.L2-3.9.1''']] Screen individuals prior to authorizing access to organizational systems containing CUI.		\| colspan="3" \| [[Practice_PS.L2-3.9.1_Details\|'''PS.L2-3.9.1''']] Screen individuals prior to authorizing access to organizational systems containing CUI.
	\|-		\|-
	\| [a] individuals are screened prior to authorizing access to organizational systems containing CUI. \|\| Artifact \|\| ~~Example~~		\| [a] individuals are screened prior to authorizing access to organizational systems containing CUI. \|\| Artifact \|\| Screenshot of records of screened personnel/background checks.
	\|}		\|}

Line 1,121:		Line 1,121:
	\| colspan="3" \| [[Practice_PS.L2-3.9.2_Details\|'''PS.L2-3.9.2''']] Ensure that organizational systems containing CUI are protected during and after personnel actions such as terminations and transfers.		\| colspan="3" \| [[Practice_PS.L2-3.9.2_Details\|'''PS.L2-3.9.2''']] Ensure that organizational systems containing CUI are protected during and after personnel actions such as terminations and transfers.
	\|-		\|-
	\| [a] a policy and/or process for terminating system access and any credentials coincident with personnel actions is established. \|\| Document \|\| ~~Example~~		\| [a] a policy and/or process for terminating system access and any credentials coincident with personnel actions is established. \|\| Document \|\| Personnel security policy/procedures/instruction; Access control policy/procedure/instruction.
	\|-		\|-
	\| [b] system access and credentials are terminated consistent with personnel actions such as termination or transfer. \|\| Artifact \|\| ~~Example~~		\| [b] system access and credentials are terminated consistent with personnel actions such as termination or transfer. \|\| Artifact \|\| Screenshot of records of personnel transfer and termination actions.
	\|-		\|-
	\| [c] the system is protected during and after personnel transfer actions. \|\| Artifact \|\| ~~Example~~		\| [c] the system is protected during and after personnel transfer actions. \|\| Artifact \|\| Completed outprocessing checklist.
	\|}		\|}

David: /* Media Protection (MP) */

2025-03-30T19:05:14Z

Media Protection (MP)

David: /* Maintenance (MA) */

2025-03-30T18:58:41Z

Maintenance (MA)

David: /* Incident Response (IR) */

2025-03-30T18:55:38Z

Incident Response (IR)

David: /* Identification and Authentication (IA) */

2025-03-30T18:52:25Z

Identification and Authentication (IA)

Show changes

← Older revision		Revision as of 19:35, 30 March 2025
Line 1,562:		Line 1,562:
	\| colspan="3" \| [[Practice_SI.L2-3.14.1_Details\|'''SI.L2-3.14.1''']] Identify, report, and correct information and information system flaws in a timely manner.		\| colspan="3" \| [[Practice_SI.L2-3.14.1_Details\|'''SI.L2-3.14.1''']] Identify, report, and correct information and information system flaws in a timely manner.
	\|-		\|-
	\| [a] the time within which to identify system flaws is specified. \|\| Document \|\| ~~Example~~		\| [a] the time within which to identify system flaws is specified. \|\| Document \|\| SSP, patch management policy.
	\|-		\|-
	\| [b] system flaws are identified within the specified time frame. \|\| Screen Share \|\| ~~Example~~		\| [b] system flaws are identified within the specified time frame. \|\| Screen Share \|\| Vulnerability management scanner output and scan policy configuration.
	\|-		\|-
	\| [c] the time within which to report system flaws is specified. \|\| Document \|\| ~~Example~~		\| [c] the time within which to report system flaws is specified. \|\| Document \|\| SSP, patch management policy.
	\|-		\|-
	\| [d] system flaws are reported within the specified time frame. \|\| Screen Share \|\| ~~Example~~		\| [d] system flaws are reported within the specified time frame. \|\| Screen Share \|\| ITSM/trouble tickets, vulnerability management scanner output.
	\|-		\|-
	\| [e] the time within which to correct system flaws is specified. \|\| Document \|\| ~~Example~~		\| [e] the time within which to correct system flaws is specified. \|\| Document \|\| SSP, patch management policy.
	\|-		\|-
	\| [f] system flaws are corrected within the specified time frame. \|\| Screen Share \|\| ~~Example~~		\| [f] system flaws are corrected within the specified time frame. \|\| Screen Share \|\| Vulnerability management scanner output and scan policy configuration.
	\|}		\|}

Line 1,583:		Line 1,583:
	\| colspan="3" \| [[Practice_SI.L2-3.14.2_Details\|'''SI.L2-3.14.2''']] Provide protection from malicious code at appropriate locations within organizational information systems.		\| colspan="3" \| [[Practice_SI.L2-3.14.2_Details\|'''SI.L2-3.14.2''']] Provide protection from malicious code at appropriate locations within organizational information systems.
	\|-		\|-
	\| [a] designated locations for malicious code protection are identified. \|\| Document \|\| ~~Example~~		\| [a] designated locations for malicious code protection are identified. \|\| Document \|\| SSP, system protection policy, network diagrams, security architecture documents.
	\|-		\|-
	\| [b] protection from malicious code at designated locations is provided. \|\| Screen Share \|\| ~~Example~~		\| [b] protection from malicious code at designated locations is provided. \|\| Screen Share \|\| Endpoint security settings, email/web proxy gateways, firewall, IPS sensor, MDM configuration, Network Access Control.
	\|}		\|}

Line 1,596:		Line 1,596:
	\| colspan="3" \| [[Practice_SI.L2-3.14.3_Details\|'''SI.L2-3.14.3''']] Monitor system security alerts and advisories and take action in response.		\| colspan="3" \| [[Practice_SI.L2-3.14.3_Details\|'''SI.L2-3.14.3''']] Monitor system security alerts and advisories and take action in response.
	\|-		\|-
	\| [a] response actions to system security alerts and advisories are identified. \|\| Document \|\| ~~Example~~		\| [a] response actions to system security alerts and advisories are identified. \|\| Document \|\| SSP, vulnerability management policy, Incident Response Plan.
	\|-		\|-
	\| [b] system security alerts and advisories are monitored. \|\| Artifact \|\| ~~Example~~		\| [b] system security alerts and advisories are monitored. \|\| Artifact \|\| Threat intelligence subscriptions, email advisories.
	\|-		\|-
	\| [c] actions in response to system security alerts and advisories are taken. \|\| Artifact \|\| ~~Example~~		\| [c] actions in response to system security alerts and advisories are taken. \|\| Artifact \|\| ITSM/trouble tickets, user notifications, updates to firewall/IPS, etc.
	\|}		\|}

Line 1,611:		Line 1,611:
	\| colspan="3" \| [[Practice_SI.L2-3.14.4_Details\|'''SI.L2-3.14.4''']] Update malicious code protection mechanisms when new releases are available.		\| colspan="3" \| [[Practice_SI.L2-3.14.4_Details\|'''SI.L2-3.14.4''']] Update malicious code protection mechanisms when new releases are available.
	\|-		\|-
	\| [a] malicious code protection mechanisms are updated when new releases are available. \|\| Screen Share \|\| ~~Example~~		\| [a] malicious code protection mechanisms are updated when new releases are available. \|\| Screen Share \|\| Antivirus console dashboard, firewall AV, Email gateway signatures,proxy, IPS updates.
	\|}		\|}

Line 1,622:		Line 1,622:
	\| colspan="3" \| [[Practice_SI.L2-3.14.5_Details\|'''SI.L2-3.14.5''']] Perform periodic scans of the information system and real-time scans of files from external sources as files are downloaded, opened, or executed.		\| colspan="3" \| [[Practice_SI.L2-3.14.5_Details\|'''SI.L2-3.14.5''']] Perform periodic scans of the information system and real-time scans of files from external sources as files are downloaded, opened, or executed.
	\|-		\|-
	\| [a] the frequency for malicious code scans is defined. \|\| Document \|\| ~~Example~~		\| [a] the frequency for malicious code scans is defined. \|\| Document \|\| SSP, vulnerability management policy.
	\|-		\|-
	\| [b] malicious code scans are performed with the defined frequency. \|\| Screen Share \|\| ~~Example~~		\| [b] malicious code scans are performed with the defined frequency. \|\| Screen Share \|\| Consoles for AV (endpoints, servers, and file shares), firewall, email gateway, proxy, IPS, MDM configurations.
	\|-		\|-
	\| [c] real-time malicious code scans of files from external sources as files are downloaded, opened, or executed are performed. \|\| Screen Share \|\| ~~Example~~		\| [c] real-time malicious code scans of files from external sources as files are downloaded, opened, or executed are performed. \|\| Screen Share \|\| Consoles for AV (endpoints, servers, and file shares), firewall, email gateway, proxy, IPS, MDM configurations.
	\|}		\|}

Line 1,637:		Line 1,637:
	\| colspan="3" \| [[Practice_SI.L2-3.14.6_Details\|'''SI.L2-3.14.6''']] Monitor organizational systems, including inbound and outbound communications traffic, to detect attacks and indicators of potential attacks.		\| colspan="3" \| [[Practice_SI.L2-3.14.6_Details\|'''SI.L2-3.14.6''']] Monitor organizational systems, including inbound and outbound communications traffic, to detect attacks and indicators of potential attacks.
	\|-		\|-
	\| [a] the system is monitored to detect attacks and indicators of potential attacks. \|\| Screen Share \|\| ~~Example~~		\| [a] the system is monitored to detect attacks and indicators of potential attacks. \|\| Screen Share \|\| Firewall, IPS, endpoint protection, SIEM alerts and reports.
	\|-		\|-
	\| [b] inbound communications traffic is monitored to detect attacks and indicators of potential attacks. \|\| Screen Share \|\| ~~Example~~		\| [b] inbound communications traffic is monitored to detect attacks and indicators of potential attacks. \|\| Screen Share \|\| Firewall, IPS, endpoint protection, SIEM alerts and reports.
	\|-		\|-
	\| [c] outbound communications traffic is monitored to detect attacks and indicators of potential attacks. \|\| Screen Share \|\| ~~Example~~		\| [c] outbound communications traffic is monitored to detect attacks and indicators of potential attacks. \|\| Screen Share \|\| Firewall, IPS, endpoint protection, SIEM alerts and reports.
	\|}		\|}

Line 1,652:		Line 1,652:
	\| colspan="3" \| [[Practice_SI.L2-3.14.7_Details\|'''SI.L2-3.14.7''']] Identify unauthorized use of organizational systems.		\| colspan="3" \| [[Practice_SI.L2-3.14.7_Details\|'''SI.L2-3.14.7''']] Identify unauthorized use of organizational systems.
	\|-		\|-
	\| [a] authorized use of the system is defined. \|\| Document \|\| ~~Example~~		\| [a] authorized use of the system is defined. \|\| Document \|\| AUP, SSP.
	\|-		\|-
	\| [b] unauthorized use of the system is identified. \|\| Artifact \|\| ~~Example~~		\| [b] unauthorized use of the system is identified. \|\| Artifact \|\| SIEM logs, endpoint protection console, IPS, Firewall.
	\|}		\|}

← Older revision		Revision as of 19:21, 30 March 2025
Line 1,270:		Line 1,270:
	\| colspan="3" \| [[Practice_CA.L2-3.12.1_Details\|'''CA.L2-3.12.1''']] Periodically assess the security controls in organizational systems to determine if the controls are effective in their application.		\| colspan="3" \| [[Practice_CA.L2-3.12.1_Details\|'''CA.L2-3.12.1''']] Periodically assess the security controls in organizational systems to determine if the controls are effective in their application.
	\|-		\|-
	\| [a] the frequency of security control assessments is defined. \|\| Document \|\| ~~Example~~		\| [a] the frequency of security control assessments is defined. \|\| Document \|\| SSP.
	\|-		\|-
	\| [b] security controls are assessed with the defined frequency to determine if the controls are effective in their application. \|\| Artifact \|\| ~~Example~~		\| [b] security controls are assessed with the defined frequency to determine if the controls are effective in their application. \|\| Artifact \|\| Copy of last security control assessment done within defined frequency.
	\|}		\|}

Line 1,283:		Line 1,283:
	\| colspan="3" \| [[Practice_CA.L2-3.12.2_Details\|'''CA.L2-3.12.2''']] Develop and implement plans of action designed to correct deficiencies and reduce or eliminate vulnerabilities in organizational systems.		\| colspan="3" \| [[Practice_CA.L2-3.12.2_Details\|'''CA.L2-3.12.2''']] Develop and implement plans of action designed to correct deficiencies and reduce or eliminate vulnerabilities in organizational systems.
	\|-		\|-
	\| [a] deficiencies and vulnerabilities to be addressed by the plan of action are identified. \|\| Artifact \|\| ~~Example~~		\| [a] deficiencies and vulnerabilities to be addressed by the plan of action are identified. \|\| Artifact \|\| Plan of Action (POA).
	\|-		\|-
	\| [b] a plan of action is developed to correct identified deficiencies and reduce or eliminate identified vulnerabilities. \|\| Artifact \|\| ~~Example~~		\| [b] a plan of action is developed to correct identified deficiencies and reduce or eliminate identified vulnerabilities. \|\| Artifact \|\| Plan of Action (POA).
	\|-		\|-
	\| [c] the plan of action is implemented to correct identified deficiencies and reduce or eliminate identified vulnerabilities. \|\| Artifact \|\| ~~Example~~		\| [c] the plan of action is implemented to correct identified deficiencies and reduce or eliminate identified vulnerabilities. \|\| Artifact \|\| Plan of Action (POA)/previously completed POAs.
	\|}		\|}

Line 1,298:		Line 1,298:
	\| colspan="3" \| [[Practice_CA.L2-3.12.3_Details\|'''CA.L2-3.12.3''']] Monitor security controls on an ongoing basis to ensure the continued effectiveness of the controls.		\| colspan="3" \| [[Practice_CA.L2-3.12.3_Details\|'''CA.L2-3.12.3''']] Monitor security controls on an ongoing basis to ensure the continued effectiveness of the controls.
	\|-		\|-
	\| [a] security controls are monitored on an ongoing basis to ensure the continued effectiveness of those controls. \|\| Artifact \|\| ~~Example~~		\| [a] security controls are monitored on an ongoing basis to ensure the continued effectiveness of those controls. \|\| Artifact \|\| Collection of risk assessment results, internal or third-party audits/security assessments and/or continuous monitoring reports/alerts (SIEM tool, etc.).
	\|}		\|}

Line 1,309:		Line 1,309:
	\| colspan="3" \| [[Practice_CA.L2-3.12.4_Details\|'''CA.L2-3.12.4''']] Develop, document, and periodically update system security plans that describe system boundaries, system environments of operation, how security requirements are implemented, and the relationships with or connections to other systems.		\| colspan="3" \| [[Practice_CA.L2-3.12.4_Details\|'''CA.L2-3.12.4''']] Develop, document, and periodically update system security plans that describe system boundaries, system environments of operation, how security requirements are implemented, and the relationships with or connections to other systems.
	\|-		\|-
	\| [a] a system security plan is developed. \|\| Document \|\| ~~Example~~		\| [a] a system security plan is developed. \|\| Document \|\| SSP.
	\|-		\|-
	\| [b] the system boundary is described and documented in the system security plan. \|\| Document \|\| ~~Example~~		\| [b] the system boundary is described and documented in the system security plan. \|\| Document \|\| SSP and any supporting documentation.
	\|-		\|-
	\| [c] the system environment of operation is described and documented in the system security plan. \|\| Document \|\| ~~Example~~		\| [c] the system environment of operation is described and documented in the system security plan. \|\| Document \|\| SSP and any supporting documentation.
	\|-		\|-
	\| [d] the security requirements identified and approved by the designated authority as non-applicable are identified. \|\| Document \|\| ~~Example~~		\| [d] the security requirements identified and approved by the designated authority as non-applicable are identified. \|\| Document \|\| SSP and required adjudication from DoD CIO.
	\|-		\|-
	\| [e] the method of security requirement implementation is described and documented in the system security plan. \|\| Document \|\| ~~Example~~		\| [e] the method of security requirement implementation is described and documented in the system security plan. \|\| Document \|\| SSP and any supporting documentation.
	\|-		\|-
	\| [f] the relationship with or connection to other systems is described and documented in the system security plan. \|\| Document \|\| ~~Example~~		\| [f] the relationship with or connection to other systems is described and documented in the system security plan. \|\| Document \|\| SSP and any supporting documentation.
	\|-		\|-
	\| [g] the frequency to update the system security plan is defined. \|\| Document \|\| ~~Example~~		\| [g] the frequency to update the system security plan is defined. \|\| Document \|\| SSP.
	\|-		\|-
	\| [h] system security plan is updated with the defined frequency. \|\| Document \|\| ~~Example~~		\| [h] system security plan is updated with the defined frequency. \|\| Document \|\| SSP/any previous versions.
	\|}		\|}

← Older revision		Revision as of 19:17, 30 March 2025
Line 1,224:		Line 1,224:
	\| colspan="3" \| [[Practice_RA.L2-3.11.1_Details\|'''RA.L2-3.11.1''']] Periodically assess the risk to organizational operations (including mission, functions, image, or reputation), organizational assets, and individuals, resulting from the operation of organizational systems and the associated processing, storage, or transmission of CUI.		\| colspan="3" \| [[Practice_RA.L2-3.11.1_Details\|'''RA.L2-3.11.1''']] Periodically assess the risk to organizational operations (including mission, functions, image, or reputation), organizational assets, and individuals, resulting from the operation of organizational systems and the associated processing, storage, or transmission of CUI.
	\|-		\|-
	\| [a] the frequency to assess risk to organizational operations, organizational assets, and individuals is defined. \|\| Document \|\| ~~Example~~		\| [a] the frequency to assess risk to organizational operations, organizational assets, and individuals is defined. \|\| Document \|\| Risk assessment policy.
	\|-		\|-
	\| [b] risk to organizational operations, organizational assets, and individuals resulting from the operation of an organizational system that processes, stores, or transmits CUI is assessed with the defined frequency. \|\| Artifact \|\| ~~Example~~		\| [b] risk to organizational operations, organizational assets, and individuals resulting from the operation of an organizational system that processes, stores, or transmits CUI is assessed with the defined frequency. \|\| Artifact \|\| Copy of last risk assessment done within defined frequency.
	\|}		\|}

Line 1,237:		Line 1,237:
	\| colspan="3" \| [[Practice_RA.L2-3.11.2_Details\|'''RA.L2-3.11.2''']] Scan for vulnerabilities in organizational systems and applications periodically and when new vulnerabilities affecting those systems and applications are identified.		\| colspan="3" \| [[Practice_RA.L2-3.11.2_Details\|'''RA.L2-3.11.2''']] Scan for vulnerabilities in organizational systems and applications periodically and when new vulnerabilities affecting those systems and applications are identified.
	\|-		\|-
	\| [a] the frequency to scan for vulnerabilities in organizational systems and applications is defined. \|\| Document \|\| ~~Example~~		\| [a] the frequency to scan for vulnerabilities in organizational systems and applications is defined. \|\| Document \|\| Policy/procedures/instruction addressing vulnerability scanning records.
	\|-		\|-
	\| [b] vulnerability scans are performed on organizational systems with the defined frequency. \|\| Screen Share \|\| ~~Example~~		\| [b] vulnerability scans are performed on organizational systems with the defined frequency. \|\| Screen Share \|\| System configuration settings of vulnerability scanning scheduling and vulnerability scan results of systems within defined frequency.
	\|-		\|-
	\| [c] vulnerability scans are performed on applications with the defined frequency. \|\| Screen Share \|\| ~~Example~~		\| [c] vulnerability scans are performed on applications with the defined frequency. \|\| Screen Share \|\| System configuration settings of vulnerability scanning scheduling and vulnerability scan results of applications within defined frequency.
	\|-		\|-
	\| [d] vulnerability scans are performed on organizational systems when new vulnerabilities are identified. \|\| Screen Share \|\| ~~Example~~		\| [d] vulnerability scans are performed on organizational systems when new vulnerabilities are identified. \|\| Screen Share \|\| View signatures in scanning tool/ad hoc scan performed as a result.
	\|-		\|-
	\| [e] vulnerability scans are performed on applications when new vulnerabilities are identified. \|\| Screen Share \|\| ~~Example~~		\| [e] vulnerability scans are performed on applications when new vulnerabilities are identified. \|\| Screen Share \|\| View signatures in scanning tool/ad hoc scan performed as a result.
	\|}		\|}

Line 1,256:		Line 1,256:
	\| colspan="3" \| [[Practice_RA.L2-3.11.3_Details\|'''RA.L2-3.11.3''']] Remediate vulnerabilities in accordance with risk assessments.		\| colspan="3" \| [[Practice_RA.L2-3.11.3_Details\|'''RA.L2-3.11.3''']] Remediate vulnerabilities in accordance with risk assessments.
	\|-		\|-
	\| [a] vulnerabilities are identified. \|\| Artifact \|\| ~~Example~~		\| [a] vulnerabilities are identified. \|\| Artifact \|\| Scan results showing vulnerabilities identified.
	\|-		\|-
	\| [b] vulnerabilities are remediated in accordance with risk assessments. \|\| Artifact \|\| ~~Example~~		\| [b] vulnerabilities are remediated in accordance with risk assessments. \|\| Artifact \|\| Screenshot/document of scan results of remediated vulnerabilities in accordance to risk assessments.
	\|}		\|}

← Older revision		Revision as of 19:14, 30 March 2025
Line 1,137:		Line 1,137:
	\| colspan="3" \| [[Practice_PE.L2-3.10.1_Details\|'''PE.L2-3.10.1''']] Limit physical access to organizational information systems, equipment, and the respective operating environments to authorized individuals.		\| colspan="3" \| [[Practice_PE.L2-3.10.1_Details\|'''PE.L2-3.10.1''']] Limit physical access to organizational information systems, equipment, and the respective operating environments to authorized individuals.
	\|-		\|-
	\| [a] authorized individuals allowed physical access are identified. \|\| Artifact \|\| ~~Example~~		\| [a] authorized individuals allowed physical access are identified. \|\| Artifact \|\| Authorized personnel (names) access list.
	\|-		\|-
	\| [b] physical access to organizational systems is limited to authorized individuals. \|\| Physical Review \|\| ~~Example~~		\| [b] physical access to organizational systems is limited to authorized individuals. \|\| Physical Review \|\| Badge reader logs, audit logs, and/or card swipe test.
	\|-		\|-
	\| [c] physical access to equipment is limited to authorized individuals. \|\| Physical Review \|\| ~~Example~~		\| [c] physical access to equipment is limited to authorized individuals. \|\| Physical Review \|\| Badge reader logs, audit logs, and/or card swipe test.
	\|-		\|-
	\| [d] physical access to operating environments is limited to authorized. \|\| Physical Review \|\| ~~Example~~		\| [d] physical access to operating environments is limited to authorized. \|\| Physical Review \|\| Badge reader logs, audit logs, and/or card swipe test.
	\|}		\|}

Line 1,154:		Line 1,154:
	\| colspan="3" \| [[Practice_PE.L2-3.10.2_Details\|'''PE.L2-3.10.2''']] Protect and monitor the physical facility and support infrastructure for organizational systems.		\| colspan="3" \| [[Practice_PE.L2-3.10.2_Details\|'''PE.L2-3.10.2''']] Protect and monitor the physical facility and support infrastructure for organizational systems.
	\|-		\|-
	\| [a] the physical facility where organizational systems reside is protected. \|\| Physical Review \|\| ~~Example~~		\| [a] the physical facility where organizational systems reside is protected. \|\| Physical Review \|\| Physical security measures and barriers into the physical facility (cameras/locks/gates/guards, etc.).
	\|-		\|-
	\| [b] the support infrastructure for organizational systems is protected. \|\| Physical Review \|\| ~~Example~~		\| [b] the support infrastructure for organizational systems is protected. \|\| Physical Review \|\| Physical barriers to entries into computer spaces, server rooms, etc.
	\|-		\|-
	\| [c] the physical facility where organizational systems reside is monitored. \|\| Physical Review \|\| ~~Example~~		\| [c] the physical facility where organizational systems reside is monitored. \|\| Physical Review \|\| Audit logs/how the physical facility is being monitored (cameras/access system/guards, etc.).
	\|-		\|-
	\| [d] the support infrastructure for organizational systems is monitored. \|\| Physical Review \|\| ~~Example~~		\| [d] the support infrastructure for organizational systems is monitored. \|\| Physical Review \|\| Audit logs/how the physical facility is being monitored (cameras/access system/guards, etc.).
	\|}		\|}

Line 1,171:		Line 1,171:
	\| colspan="3" \| [[Practice_PE.L2-3.10.3_Details\|'''PE.L2-3.10.3''']] Escort visitors and monitor visitor activity.		\| colspan="3" \| [[Practice_PE.L2-3.10.3_Details\|'''PE.L2-3.10.3''']] Escort visitors and monitor visitor activity.
	\|-		\|-
	\| [a] visitors are escorted. \|\| Physical Review \|\| ~~Example~~		\| [a] visitors are escorted. \|\| Physical Review \|\| Policy/procedures/instruction on methodology for handling non-authorized personnel (entry to exit).
	\|-		\|-
	\| [b] visitor activity is monitored. \|\| Physical Review \|\| ~~Example~~		\| [b] visitor activity is monitored. \|\| Physical Review \|\| Policy/procedures/instructio on methodology for handling non-authorized personnel (entry to exit).
	\|}		\|}

Line 1,184:		Line 1,184:
	\| colspan="3" \| [[Practice_PE.L2-3.10.4_Details\|'''PE.L2-3.10.4''']] Maintain audit logs of physical access.		\| colspan="3" \| [[Practice_PE.L2-3.10.4_Details\|'''PE.L2-3.10.4''']] Maintain audit logs of physical access.
	\|-		\|-
	\| [a] audit logs of physical access are maintained. \|\| Artifact \|\| ~~Example~~		\| [a] audit logs of physical access are maintained. \|\| Artifact \|\| Log or report from badging system.
	\|}		\|}

Line 1,195:		Line 1,195:
	\| colspan="3" \| [[Practice_PE.L2-3.10.5_Details\|'''PE.L2-3.10.5''']] Control and manage physical access devices.		\| colspan="3" \| [[Practice_PE.L2-3.10.5_Details\|'''PE.L2-3.10.5''']] Control and manage physical access devices.
	\|-		\|-
	\| [a] physical access devices are identified. \|\| Document \|\| ~~Example~~		\| [a] physical access devices are identified. \|\| Document \|\| Physical access control systems description, guard force contract/policy, key locks, logical systems specifications, etc.
	\|-		\|-
	\| [b] physical access devices are controlled. \|\| Physical Review \|\| ~~Example~~		\| [b] physical access devices are controlled. \|\| Physical Review \|\| Inventory records of physical access control devices (e.g. keys, locks, card readers, locks, etc.).
	\|-		\|-
	\| [c] physical access devices are managed. \|\| Physical Review \|\| ~~Example~~		\| [c] physical access devices are managed. \|\| Physical Review \|\| List of security safeguards controlling access to the facility (e.g. cameras, monitoring by guards, isolation of IT systems equiment and or system components).
	\|}		\|}

Line 1,210:		Line 1,210:
	\| colspan="3" \| [[Practice_PE.L2-3.10.6_Details\|'''PE.L2-3.10.6''']] Enforce safeguarding measures for CUI at alternate work sites.		\| colspan="3" \| [[Practice_PE.L2-3.10.6_Details\|'''PE.L2-3.10.6''']] Enforce safeguarding measures for CUI at alternate work sites.
	\|-		\|-
	\| [a] safeguarding measures for CUI are defined for alternate work sites. \|\| Document \|\| ~~Example~~		\| [a] safeguarding measures for CUI are defined for alternate work sites. \|\| Document \|\| Telework agreement, Acceptable Use Policy and SOP for alternate work locations; user security training validation which includes physical/logical/technical protections of system at alternate work sites.
	\|-		\|-
	\| [b] safeguarding measures for CUI are enforced for alternate work sites. \|\| Artifact \|\| ~~Example~~		\| [b] safeguarding measures for CUI are enforced for alternate work sites. \|\| Artifact \|\| Monitoring/audit log of user activity and logical/physical/technical mechanisms in place to preclude unauthorized activity (telework agreement , AUP?).
	\|}		\|}

← Older revision		Revision as of 19:05, 30 March 2025
Line 998:		Line 998:
	\| colspan="3" \| [[Practice_MP.L2-3.8.1_Details\|'''MP.L2-3.8.1''']] Protect (i.e., physically control and securely store) system media containing CUI, both paper and digital.		\| colspan="3" \| [[Practice_MP.L2-3.8.1_Details\|'''MP.L2-3.8.1''']] Protect (i.e., physically control and securely store) system media containing CUI, both paper and digital.
	\|-		\|-
	\| [a] paper media containing CUI is physically controlled. \|\| Document \|\| ~~Example~~		\| [a] paper media containing CUI is physically controlled. \|\| Document \|\| Policy showing CUI paper media is controlled; artifact showing who has access; artifacts/records of inventories conducted; media check out procedures (i.e. file cabinets, encryption, password protection).
	\|-		\|-
	\| [b] digital media containing CUI is physically controlled. \|\| Document \|\| ~~Example~~		\| [b] digital media containing CUI is physically controlled. \|\| Document \|\| Policy showing CUI digital media is controlled; artifact showing who has access; artifacts/records of inventories conducted; media check out procedures (i.e. file cabinets, external drives, USBs, encryption, password protection).
	\|-		\|-
	\| [c] paper media containing CUI is securely stored. \|\| Physical Review \|\| ~~Example~~		\| [c] paper media containing CUI is securely stored. \|\| Physical Review \|\| Check out/sign out sheets; possible photo of storage container/video walk through of storage area; badge reader logs or access lists for keys for secured areas; interview response considered (i.e. file cabinets, encryption, password protection).
	\|-		\|-
	\| [d] digital media containing CUI is securely stored. \|\| Physical Review \|\| ~~Example~~		\| [d] digital media containing CUI is securely stored. \|\| Physical Review \|\| Check out/sign out sheets; possible photo of storage container/video walk through of storage area; badge reader logs or access lists for keys for secured areas; interview response considered (i.e. file cabinets, external drives, USBs, encryption, password protection).
	\|}		\|}

Line 1,015:		Line 1,015:
	\| colspan="3" \| [[Practice_MP.L2-3.8.2_Details\|'''MP.L2-3.8.2''']] Limit access to CUI on system media to authorized users.		\| colspan="3" \| [[Practice_MP.L2-3.8.2_Details\|'''MP.L2-3.8.2''']] Limit access to CUI on system media to authorized users.
	\|-		\|-
	\| [a] access to CUI on system media is limited to authorized users. \|\| Artifact \|\| ~~Example~~		\| [a] access to CUI on system media is limited to authorized users. \|\| Artifact \|\| Document describing how CUI is limited AND artifact showing principle of least access is implemented.
	\|}		\|}

Line 1,026:		Line 1,026:
	\| colspan="3" \| [[Practice_MP.L2-3.8.3_Details\|'''MP.L2-3.8.3''']] Sanitize or destroy information system media containing Federal Contract Information before disposal or release for reuse.		\| colspan="3" \| [[Practice_MP.L2-3.8.3_Details\|'''MP.L2-3.8.3''']] Sanitize or destroy information system media containing Federal Contract Information before disposal or release for reuse.
	\|-		\|-
	\| [a] system media containing CUI is sanitized or destroyed before disposal. \|\| Document \|\| ~~Example~~		\| [a] system media containing CUI is sanitized or destroyed before disposal. \|\| Document \|\| Policy or artifact of media destruction logs; certificates of destruction; SLAs or contracts.
	\|-		\|-
	\| [b] system media containing CUI is sanitized before it is released for reuse. \|\| Document \|\| ~~Example~~		\| [b] system media containing CUI is sanitized before it is released for reuse. \|\| Document \|\| Policy or artifact describing method to sanitize, software used (i.e. DoD Wipe, ShredIT and Iron Mountain; Blancco; GDisk, DBAN).
	\|}		\|}

Line 1,039:		Line 1,039:
	\| colspan="3" \| [[Practice_MP.L2-3.8.4_Details\|'''MP.L2-3.8.4''']] Mark media with necessary CUI markings and distribution limitations.		\| colspan="3" \| [[Practice_MP.L2-3.8.4_Details\|'''MP.L2-3.8.4''']] Mark media with necessary CUI markings and distribution limitations.
	\|-		\|-
	\| [a] media containing CUI is marked with applicable CUI markings. \|\| Physical Review \|\| ~~Example~~		\| [a] media containing CUI is marked with applicable CUI markings. \|\| Physical Review \|\| Document or artifact showing CUI markings (i.e. labeling standards ).
	\|-		\|-
	\| [b] media containing CUI is marked with distribution limitations. \|\| Physical Review \|\| ~~Example~~		\| [b] media containing CUI is marked with distribution limitations. \|\| Physical Review \|\| Document or artifact showing distro limitations (i.e. labeling standards ).
	\|}		\|}

Line 1,052:		Line 1,052:
	\| colspan="3" \| [[Practice_MP.L2-3.8.5_Details\|'''MP.L2-3.8.5''']] Control access to media containing CUI and maintain accountability for media during transport outside of controlled areas.		\| colspan="3" \| [[Practice_MP.L2-3.8.5_Details\|'''MP.L2-3.8.5''']] Control access to media containing CUI and maintain accountability for media during transport outside of controlled areas.
	\|-		\|-
	\| [a] access to media containing CUI is controlled. \|\| ~~Artifact~~ \|\| ~~Example~~		\| [a] access to media containing CUI is controlled. \|\| Document \|\| Policy, artifact of audit logs showing tracking, Access Control Lists, records of transport activities (i.e. USB drives, CDs, chain of custody.
	\|-		\|-
	\| [b] accountability for media containing CUI is maintained during transport outside of controlled areas. \|\| ~~Document~~ \|\| ~~Example~~		\| [b] accountability for media containing CUI is maintained during transport outside of controlled areas. \|\| Artifact \|\| Artifact of audit logs showing tracking, Access Control Lists, records of transport activities (i.e. USB drives, CDs; chain of custody.
	\|}		\|}

Line 1,065:		Line 1,065:
	\| colspan="3" \| [[Practice_MP.L2-3.8.6_Details\|'''MP.L2-3.8.6''']] Implement cryptographic mechanisms to protect the confidentiality of CUI stored on digital media during transport unless otherwise protected by alternative physical safeguards.		\| colspan="3" \| [[Practice_MP.L2-3.8.6_Details\|'''MP.L2-3.8.6''']] Implement cryptographic mechanisms to protect the confidentiality of CUI stored on digital media during transport unless otherwise protected by alternative physical safeguards.
	\|-		\|-
	\| [a] the confidentiality of CUI stored on digital media is protected during transport using cryptographic mechanisms or alternative physical safeguards. \|\| Artifact \|\| ~~Example~~		\| [a] the confidentiality of CUI stored on digital media is protected during transport using cryptographic mechanisms or alternative physical safeguards. \|\| Artifact \|\| Artifact showing crypto mechanisms used to protect (are they FIPS 140-2 [13.11]); artifact showing what alternative physical safeguards are in place (i.e. encryption; BitLocker; McAfee ).
	\|}		\|}

Line 1,076:		Line 1,076:
	\| colspan="3" \| [[Practice_MP.L2-3.8.7_Details\|'''MP.L2-3.8.7''']] Control the use of removable media on system components.		\| colspan="3" \| [[Practice_MP.L2-3.8.7_Details\|'''MP.L2-3.8.7''']] Control the use of removable media on system components.
	\|-		\|-
	\| [a] the use of removable media on system components is controlled. \|\| Artifact \|\| ~~Example~~		\| [a] the use of removable media on system components is controlled. \|\| Artifact \|\| Policy showing if removable media is allowed; writable removable media is restricted; tracking artifacts; what tools are used (i.e. Carbon Black, Crowd Strike, GPO, Zoho Desktop Central); procedure/process describing what happens if it is lost; what mechanisms are in place to control/restrict removable media (i.e. Active Directory Groups and Group Policy artifact showing restriction).
	\|}		\|}

Line 1,087:		Line 1,087:
	\| colspan="3" \| [[Practice_MP.L2-3.8.8_Details\|'''MP.L2-3.8.8''']] Prohibit the use of portable storage devices when such devices have no identifiable owner.ASSESSMENT OBJECTIVES'''		\| colspan="3" \| [[Practice_MP.L2-3.8.8_Details\|'''MP.L2-3.8.8''']] Prohibit the use of portable storage devices when such devices have no identifiable owner.ASSESSMENT OBJECTIVES'''
	\|-		\|-
	\| [a] the use of portable storage devices is prohibited when such devices have no identifiable owner. \|\| Artifact \|\| ~~Example~~		\| [a] the use of portable storage devices is prohibited when such devices have no identifiable owner. \|\| Artifact \|\| Policy and/or artifact showing company stance on portable storage devices if there is no owner (are personal USB devices allowed or are they company-issued; artifact showing alerts if device is connected to network (i.e. external HDD, Carbon Black, Crowd Strike, GPO, Zoho Desktop Central.
	\|}		\|}

Line 1,098:		Line 1,098:
	\| colspan="3" \| [[Practice_MP.L2-3.8.9_Details\|'''MP.L2-3.8.9''']] Protect the confidentiality of backup CUI at storage locations.		\| colspan="3" \| [[Practice_MP.L2-3.8.9_Details\|'''MP.L2-3.8.9''']] Protect the confidentiality of backup CUI at storage locations.
	\|-		\|-
	\| [a] the confidentiality of backup CUI is protected at storage locations. \|\| Artifact \|\| ~~Example~~		\| [a] the confidentiality of backup CUI is protected at storage locations. \|\| Artifact \|\| Policy on system backups; artifact showing media labeling; artifact showing encyption (is it FIPS 140-2 [13.11]); Access Control List artifact (i.e. backup tapes, Tivoli Storage Manager).
	\|}		\|}

← Older revision		Revision as of 18:58, 30 March 2025
Line 923:		Line 923:
	\| colspan="3" \| [[Practice_MA.L2-3.7.1_Details\|'''MA.L2-3.7.1''']] Perform maintenance on organizational systems.		\| colspan="3" \| [[Practice_MA.L2-3.7.1_Details\|'''MA.L2-3.7.1''']] Perform maintenance on organizational systems.
	\|-		\|-
	\| [a] system maintenance is performed. \|\| Artifact \|\| ~~Example~~		\| [a] system maintenance is performed. \|\| Artifact \|\| Establish typical maintenance activities (HVAC, UPS, power distribution, generators, copier maintenance) that are performed; maintenance agreements or contracts detailing these types of activities are acceptable; interview responses should be considered. This requirement should not be confused with 3.14.1 - report, remediate, and correct system flaws in a timely manner (patch management).
	\|}		\|}

Line 934:		Line 934:
	\| colspan="3" \| [[Practice_MA.L2-3.7.2_Details\|'''MA.L2-3.7.2''']] Provide controls on the tools, techniques, mechanisms, and personnel used to conduct system maintenance.		\| colspan="3" \| [[Practice_MA.L2-3.7.2_Details\|'''MA.L2-3.7.2''']] Provide controls on the tools, techniques, mechanisms, and personnel used to conduct system maintenance.
	\|-		\|-
	\| [a] tools used to conduct system maintenance are controlled. \|\| Artifact \|\| ~~Example~~		\| [a] tools used to conduct system maintenance are controlled. \|\| Artifact \|\| Tools may largely depend on the assessed environment; discussion examples include network diagnostic and monitoring tools (including hardware and software); artifacts could demonstrate secured locations/areas for these tools (photos) or checkout sheets/rosters (documents) depicting responsible personnel and the dates/times of checkout.
	\|-		\|-
	\| [b] techniques used to conduct system maintenance are controlled. \|\| Artifact \|\| ~~Example~~		\| [b] techniques used to conduct system maintenance are controlled. \|\| Artifact \|\| Processes for scheduling, performing, documenting, reviewing, approving, and monitoring maintenance and repairs for the information system.
	\|-		\|-
	\| [c] mechanisms used to conduct system maintenance are controlled. \|\| Artifact \|\| ~~Example~~		\| [c] mechanisms used to conduct system maintenance are controlled. \|\| Artifact \|\| Processes for scheduling, performing, documenting, reviewing, approving, and monitoring maintenance and repairs for the information system.
	\|-		\|-
	\| [d] personnel used to conduct system maintenance are controlled. \|\| Physical Review \|\| ~~Example~~		\| [d] personnel used to conduct system maintenance are controlled. \|\| Physical Review \|\| Screenshot of who is authorized to conduct maintenance; maintenance personnel training program.
	\|}		\|}

Line 951:		Line 951:
	\| colspan="3" \| [[Practice_MA.L2-3.7.3_Details\|'''MA.L2-3.7.3''']] Ensure equipment removed for off-site maintenance is sanitized of any CUI.		\| colspan="3" \| [[Practice_MA.L2-3.7.3_Details\|'''MA.L2-3.7.3''']] Ensure equipment removed for off-site maintenance is sanitized of any CUI.
	\|-		\|-
	\| [a] equipment to be removed from organizational spaces for off-site maintenance is sanitized of any CUI. \|\| Artifact \|\| ~~Example~~		\| [a] equipment to be removed from organizational spaces for off-site maintenance is sanitized of any CUI. \|\| Artifact \|\| Document or artifact; record if equipment sanitized; categories of sanitization/destruction defined; sanitization procedural document.
	\|}		\|}

Line 962:		Line 962:
	\| colspan="3" \| [[Practice_MA.L2-3.7.4_Details\|'''MA.L2-3.7.4''']] Check media containing diagnostic and test programs for malicious code before the media are used in organizational systems.		\| colspan="3" \| [[Practice_MA.L2-3.7.4_Details\|'''MA.L2-3.7.4''']] Check media containing diagnostic and test programs for malicious code before the media are used in organizational systems.
	\|-		\|-
	\| [a] media containing diagnostic and test programs are checked for malicious code before being used in organizational systems that process, store, or transmit CUI. \|\| Artifact \|\| ~~Example~~		\| [a] media containing diagnostic and test programs are checked for malicious code before being used in organizational systems that process, store, or transmit CUI. \|\| Artifact \|\| Screenshot of diagnostic/test program being used (such as Symantec and McAfee on access scans…).
	\|}		\|}

Line 973:		Line 973:
	\| colspan="3" \| [[Practice_MA.L2-3.7.5_Details\|'''MA.L2-3.7.5''']] Require multifactor authentication to establish nonlocal maintenance sessions via external network connections and terminate such connections when nonlocal maintenance is complete.		\| colspan="3" \| [[Practice_MA.L2-3.7.5_Details\|'''MA.L2-3.7.5''']] Require multifactor authentication to establish nonlocal maintenance sessions via external network connections and terminate such connections when nonlocal maintenance is complete.
	\|-		\|-
	\| [a] multifactor authentication is used to establish nonlocal maintenance sessions via external network connections. \|\| Screen Share \|\| ~~Example~~		\| [a] multifactor authentication is used to establish nonlocal maintenance sessions via external network connections. \|\| Screen Share \|\| Describe MFA used to remote from external service to organizational systems for maintenance and screenshot of MFA (3.5.3)(points associated with admin).
	\|-		\|-
	\| [b] nonlocal maintenance sessions established via external network connections are terminated when nonlocal maintenance is complete. \|\| Screen Share \|\| ~~Example~~		\| [b] nonlocal maintenance sessions established via external network connections are terminated when nonlocal maintenance is complete. \|\| Screen Share \|\| Screenshot VPN session timeout.
	\|}		\|}

Line 986:		Line 986:
	\| colspan="3" \| [[Practice_MA.L2-3.7.6_Details\|'''MA.L2-3.7.6''']] Supervise the maintenance activities of maintenance personnel without required access authorization.		\| colspan="3" \| [[Practice_MA.L2-3.7.6_Details\|'''MA.L2-3.7.6''']] Supervise the maintenance activities of maintenance personnel without required access authorization.
	\|-		\|-
	\| [a] maintenance personnel without required access authorization are supervised during maintenance activities. \|\| Document \|\| ~~Example~~		\| [a] maintenance personnel without required access authorization are supervised during maintenance activities. \|\| Document \|\| System maintenance policy; list of authorized personnel; maintenance records or, contracts/SLAs; WebEx.
	\|}		\|}

← Older revision		Revision as of 18:55, 30 March 2025
Line 866:		Line 866:
	\| colspan="3" \| [[Practice_IR.L2-3.6.1_Details\|'''IR.L2-3.6.1''']] Establish an operational incident-handling capability for organizational systems that includes preparation, detection, analysis, containment, recovery, and user response activities.		\| colspan="3" \| [[Practice_IR.L2-3.6.1_Details\|'''IR.L2-3.6.1''']] Establish an operational incident-handling capability for organizational systems that includes preparation, detection, analysis, containment, recovery, and user response activities.
	\|-		\|-
	\| [a] an operational incident-handling capability is established. \|\| Document \|\| ~~Example~~		\| [a] an operational incident-handling capability is established. \|\| Document \|\| Incident Response SOP/Plan.
	\|-		\|-
	\| [b] the operational incident-handling capability includes preparation. \|\| Document \|\| ~~Example~~		\| [b] the operational incident-handling capability includes preparation. \|\| Document \|\| Incident Response SOP/Plan, prior incident report, training, COOP plan.
	\|-		\|-
	\| [c] the operational incident-handling capability includes detection. \|\| Document \|\| ~~Example~~		\| [c] the operational incident-handling capability includes detection. \|\| Document \|\| Incident Response SOP/Plan; definition of tools used to detect; artifacts showing tools used; prior incident report.
	\|-		\|-
	\| [d] the operational incident-handling capability includes analysis. \|\| Document \|\| ~~Example~~		\| [d] the operational incident-handling capability includes analysis. \|\| Document \|\| Incident Response SOP/Plan; Definition of tools used to analyze potential incidents; artifacts showing tools used for analysis; prior incident report.
	\|-		\|-
	\| [e] the operational incident-handling capability includes containment. \|\| Document \|\| ~~Example~~		\| [e] the operational incident-handling capability includes containment. \|\| Document \|\| Incident Response SOP/Plan; isolation/quarantine process; user training.
	\|-		\|-
	\| [f] the operational incident-handling capability includes recovery. \|\| Document \|\| ~~Example~~		\| [f] the operational incident-handling capability includes recovery. \|\| Document \|\| Incident Response SOP/Plan; COOP Plan; prior incident reports, re-baselining impacted devices.
	\|-		\|-
	\| [g] the operational incident-handling capability includes user response. \|\| Document \|\| ~~Example~~		\| [g] the operational incident-handling capability includes user response. \|\| Document \|\| Incident Response SOP/Plan; user awareness training; Help Desk process.

	\|}		\|}

Line 889:		Line 890:
	\| colspan="3" \| [[Practice_IR.L2-3.6.2_Details\|'''IR.L2-3.6.2''']] Track, document, and report incidents to designated officials and/or authorities both internal and external to the organization.		\| colspan="3" \| [[Practice_IR.L2-3.6.2_Details\|'''IR.L2-3.6.2''']] Track, document, and report incidents to designated officials and/or authorities both internal and external to the organization.
	\|-		\|-
	\| [a] incidents are tracked. \|\| Artifact \|\| ~~Example~~		\| [a] incidents are tracked. \|\| Artifact \|\| Incident Response SOP/Plan; ITSM artifact; technical implementation for incident tracking.
	\|-		\|-
	\| [b] incidents are documented. \|\| Artifact \|\| ~~Example~~		\| [b] incidents are documented. \|\| Artifact \|\| Incident Response SOP/Plan; ITSM artifact; technical implementation for incident tracking.
	\|-		\|-
	\| [c] authorities to whom incidents are to be reported are identified. \|\| Document \|\| ~~Example~~		\| [c] authorities to whom incidents are to be reported are identified. \|\| Document \|\| Incident Response SOP/Plan.
	\|-		\|-
	\| [d] organizational officials to whom incidents are to be reported are identified. \|\| Document \|\| ~~Example~~		\| [d] organizational officials to whom incidents are to be reported are identified. \|\| Document \|\| Incident Response SOP/Plan.
	\|-		\|-
	\| [e] identified authorities are notified of incidents. \|\| Screen Share \|\| ~~Example~~		\| [e] identified authorities are notified of incidents. \|\| Screen Share \|\| Prior incident report; DIBNET login; prior email notifications.
	\|-		\|-
	\| [f] identified organizational officials are notified of incidents. \|\| Artifact \|\| ~~Example~~		\| [f] identified organizational officials are notified of incidents. \|\| Artifact \|\| Prior incident report; prior email notifications; tabletop exercises.
	\|}		\|}

Line 910:		Line 911:
	\| colspan="3" \| [[Practice_IR.L2-3.6.3_Details\|'''IR.L2-3.6.3''']] Test the organizational incident response capability.		\| colspan="3" \| [[Practice_IR.L2-3.6.3_Details\|'''IR.L2-3.6.3''']] Test the organizational incident response capability.
	\|-		\|-
	\| [a] the incident response capability is tested. \|\| Artifact \|\| ~~Example~~		\| [a] the incident response capability is tested. \|\| Artifact \|\| Incident response table top/scheduled or unscheduled test or penetration test.
	\|}		\|}