CCI-002812

Implementation Guidance

Determine if [IR-09_ODP[03]; actions to be performed are defined] are performed in response to information spills.

Validation Procedures

Examine: [SELECT FROM: Incident response policy; procedures addressing information spillage; incident response plan; system security plan; records of information spillage alerts/notifications; list of personnel who should receive alerts of information spillage; list of actions to be performed regarding information spillage; other relevant documents or records]. Interview: [SELECT FROM: Organizational personnel with incident response responsibilities; organizational personnel with information security responsibilities]. Test: [SELECT FROM: Organizational processes for information spillage response; mechanisms supporting and/or implementing information spillage response actions and related communications].