IR-9(4) INFORMATION SPILLAGE RESPONSE | EXPOSURE TO UNAUTHORIZED PERSONNEL |
Scroll Prev Top Next More |
Applicable (Y)es / (N)o |
(C)onfidentiality |
(I)ntegrity |
(A)vailability |
RPN (C+I+A) |
(S)atisfactory |
||||||
L1 |
M2 |
H3 |
L1 |
M2 |
H3 |
L1 |
M2 |
H3 |
(O)ther than satisfactory +## |
||
|
|
|
|
|
|
|
|
|
|
|
|
###
ir-9(4) |
information spillage response | exposure to unauthorized personnel |
|
|
assessment objective: Determine if the organization: |
|
ir-9(4)[1] |
defines security safeguards to be employed for personnel exposed to information not within assigned access authorizations; and |
|
ir-9(4)[2] |
employs organization-defined security safeguards for personnel exposed to information not within assigned access authorizations. |
|
potential assessment methods and objects: Examine: [SELECT FROM: Incident response policy; procedures addressing incident handling; procedures addressing information spillage; incident response plan; security safeguards regarding information spillage/exposure to unauthorized personnel; other relevant documents or records]. Interview: [SELECT FROM: Organizational personnel with incident response responsibilities; organizational personnel with information security responsibilities]. Test: [select from: Organizational processes for dealing with information exposed to unauthorized personnel; automated mechanisms supporting and/or implementing safeguards for personnel exposed to information not within assigned access authorizations]. |