3.11.5e

Assess the effectiveness of security solutions [Assignment: organization-defined frequency] to address anticipated risk to organizational systems and the organization based on current and accumulated threat intelligence.

DISCUSSION

Threat awareness and risk assessment of the organization are dynamic, continuous, and inform system operations, security requirements for the system, and the security solutions employed to meet those requirements. Threat intelligence (i.e., threat information that has been aggregated, transformed, analyzed, interpreted, or enriched to help provide the necessary context for decision making) is infused into the risk assessment processes and information security operations of the organization to identify any changes required to address the dynamic threat environment. [SP 800-30] provides guidance on risk assessments, threat assessments, and risk analyses.

PROTECTION STRATEGY

Damage-Limiting Operations.

ADVERSARY EFFECTS

See [SP 800-160-2]: [Expose (Scrutinize)].

ASSESSMENT OBJECTIVE

Determine if:

3.11.5e_ODP[1] The frequency to assess the effectiveness of security solutions is defined.

3.11.5e[a] Security solutions are identified.

3.11.5e[b] Current and accumulated threat intelligence is identified.

3.11.5e[c] Anticipated risk to organizational systems and the organization based on current and accumulated threat intelligence is identified.

3.11.5e[d] The effectiveness of security solutions is assessed <3.11.5e_ODP[1]: frequency> to address anticipated risk to organizational systems and the organization based on current and accumulated threat intelligence.

POTENTIAL ASSESSMENT METHODS AND OBJECTS

Examine: [SELECT FROM: Risk assessment policy; security planning policy and procedures; security assessment policy and procedures; security assessment plans; security assessment results; procedures addressing organizational assessments of risk; security plan; risk assessment; risk assessment results; risk assessment reviews; risk assessment updates; threat intelligence information; other relevant documents or records].

Interview: [SELECT FROM: Organizational personnel responsible for security assessments; organizational personnel responsible for risk assessments; organizational personnel responsible for threat analysis; organizational personnel responsible for information security].

Test: [SELECT FROM: Mechanisms supporting, conducting, documenting, reviewing, disseminating, and updating risk assessments; mechanisms supporting and/or implementing security assessments].