Applicable

(Y)es / (N)o

(C)onfidentiality

(I)ntegrity

(A)vailability

RPN

(C+I+A)

(S)atisfactory

L1

M2

H3

L1

M2

H3

L1

M2

H3

(O)ther than satisfactory +##

ir-9

information spillage response  

assessment objective:

Determine if the organization:  

ir-9(a)

responds to information spills by identifying the specific information causing the information system contamination;

ir-9(b)  

ir-9(b)[1]

defines personnel to be alerted of the information spillage;

ir-9(b)[2]

identifies a method of communication not associated with the information spill to use to alert organization-defined personnel of the spill;

ir-9(b)[3]

responds to information spills by alerting organization-defined personnel of the information spill using a method of communication not associated with the spill;

ir-9(c)  

responds to information spills by isolating the contaminated information system;

ir-9(d)  

responds to information spills by eradicating the information from the contaminated information system;

ir-9(e)  

responds to information spills by identifying other information systems that may have been subsequently contaminated;

ir-9(f)  

ir-9(f)[1]

defines other actions to be performed in response to information spills; and

ir-9(f)[2]

responds to information spills by performing other organization-defined actions.

potential assessment methods and objects:

Examine: [SELECT FROM: Incident response policy; procedures addressing information spillage; incident response plan; records of information spillage alerts/notifications, list of personnel who should receive alerts of information spillage; list of actions to be performed regarding information spillage; other relevant documents or records].

Interview: [SELECT FROM: Organizational personnel with incident response responsibilities; organizational personnel with information security responsibilities].

Test: [select from: Organizational processes for information spillage response; automated mechanisms supporting and/or implementing information spillage response actions and related communications].