CCI-002099

Employ organization-defined red team exercises to simulate attempts by adversaries to compromise organizational systems in accordance with applicable rules of engagement.

Implementation Guidance

Determine if [CA-08(02)_ODP; red team exercises to simulate attempts by adversaries to compromise Organizational systems are defined] are employed to simulate attempts by adversaries to compromise Organizational systems in accordance with applicable rules of engagement.

Validation Procedures

Examine: [SELECT FROM: Assessment, authorization, and monitoring policy; procedures addressing penetration testing; procedures addressing red team exercises; assessment plan; results of red team exercises; penetration test report; assessment report; rules of engagement; assessment evidence; system security plan; privacy plan; other relevant documents or records]. Interview: [SELECT FROM: Organizational personnel with assessment responsibilities; organizational personnel with information security and privacy responsibilities; system/network administrators]. Test: [SELECT FROM: Mechanisms supporting the employment of red team exercises].

The controls below (if any) were marked by NIST as being related to CCI-002099.