IR-4(5)

Requirement

Implement a configurable capability to automatically disable the system if [Assignment: organization-defined security violations] are detected.

Discussion

Organizations consider whether the capability to automatically disable the system conflicts with continuity of operations requirements specified as part of CP-2 or IR-4(3). Security violations include cyber-attacks that have compromised the integrity of the system or exfiltrated organizational information and serious errors in software programs that could adversely impact organizational missions or functions or jeopardize the safety of individuals.

NIST 800-53A Assessment Guidance

Examine

[SELECT FROM: Incident response policy; procedures addressing incident handling; automated mechanisms supporting incident handling; system design documentation; system configuration settings and associated documentation; system security plan; incident response plan; privacy plan; other relevant documents or records].

Interview

[SELECT FROM: Organizational personnel with incident handling responsibilities; organizational personnel with information security responsibilities; system developers].

Test

[SELECT FROM: Incident handling capability for the organization; automated mechanisms supporting and/or implementing automatic disabling of the system].

ID	Assessment Objectives
IR-04(05)	a configurable capability is implemented to automatically disable the system if <IR-04(05)_ODP security violations> are detected.

Our CMMC Overview Course simplifies CMMC. Enroll so you can make informed decisions!