Attachment N_ITOPS IRP Test Script Template.doc
DOC document 902 KB Posted
- Solicitation number
- 36C10B21R0039
About this file
This document contains a template for testing an incident response plan for a federal agency application. The template includes a testing scenario, objectives, instructions, and questions to validate preparation, response procedures, and documentation for each stage of incident response. Participants and roles are to be documented. The test is intended to meet annual requirements, train personnel, and identify updates to the response plan. Key details include testing preparation, detection and analysis of incidents, containment and recovery procedures, and post-incident follow-up documentation. The template requires documenting the agency application, test date and location, participants, and responses to validate objectives across each response stage. Lessons learned and corrective actions must also be documented to improve future response.
View the file
Other files
Show all 15
On GovTribe
Work with this file
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
VAEC [APPLICATION ACRONYM] Incident Response Plan Testing Scenario and Summary Worksheet
COMMENTS \* FirstCap \* MERGEFORMAT U.S. DEPARTMENT OF VETERANS AFFAIRS
VA Enterprise Cloud (VAEC) [Application Name] [(APPLICATION ACRONYM)] Incident Response Plan
Testing Scenario and Summary Worksheet
· This packet includes the scenario and summary questions to be completed for annual IRP testing requirements.
· Response section will expand upon text entry and has an unlimited character limit.
· Upload completed package to the appropriate location in GRC.
Testing Scenario:
**This is a tabletop, non-disruptive exercise. Power will not be removed, and production services will not be interrupted**
Scope This exercise applies to the four stages of incident response as outlined in the Incident Response Plan (IRP): Preparation; Detection, Reporting, and Analysis; Containment, Eradication, and Recovery; and Post-Incident Follow-up as well as the associated roles and responsibilities of incident response personnel required for each stage. P Purpose
The purpose of this exercise is to meet annual IRP testing requirements as well as training requirements for those in attendance, ensure key personnel can perform their incident response roles and responsibilities as indicated in the IRP, and determine if the IRP captures all roles and responsibilities needed to effectively respond to an incident.
IRP TEST Objectives
Objectives: To test the capacity of [APPLICATION ACRONYM] incident response personnel to effectively respond to an incident per their assigned roles and responsibilities.
Objective #1: Verify [APPLICATION ACRONYM] is prepared to respond to an incident.
Objective #2: Demonstrate an understanding of the procedural steps of the IRP stages of Preparation; Detection, Reporting, and Analysis; Containment, Eradication, and Recovery; and Post-Incident Follow-up by [APPLICATION ACRONYM] incident response personnel.
Objective #3: Verify the specified time-period and process for submitting the Privacy and Security Event Tracking System (PSETS) ticket to the VA CSOC.
Objective #4: Validate personnel on the Incident Notification Contact List are the appropriate personnel and their contact information is correct.
Objective #5: Verify that the FCIO coordinates with VA-level entities and advises on containment procedures and that the hardware/software involved in the incident is safeguarded appropriately.
Objective #6: Identify [APPLICATION ACRONYM] recovery steps that may be required for the stated test scenario.
Objective #7: Validate that the processes and procedures of IRP testing have been documented, and that the recommended updates to be made to the IRP are captured as “Lessons Learned.”
Instructions
IRP Test activities include:
· Coordinating a tabletop exercise to establish procedures and outcomes of IRP stages and corresponding roles and responsibilities
· Locating the [APPLICATION ACRONYM] IRP
· Verifying all incident response personnel have a copy of the IRP
· Providing incident response personnel with the scope of the exercise to familiarize themselves with the content of the IRP
· Notifying incident response personnel in advance of the date and time specified to perform the IRP Test
· Following the IRP testing exercise and ensuring incident response personnel perform their duties as captured in the IRP
· Documenting and answering all questions for [APPLICATION ACRONYM] IRP testing activities using the Summary Worksheet contained in the Scenario Package
· Designating observer(s) to collect information during the exercise test, noting the processes that worked well and those that did not in the “Lessons Learned” section of the checklist Assumptions
1. The [APPLICATION ACRONYM] has an IRP and it has been disseminated to all incident response personnel.
2. All incident response personnel are given at least 10 days’ notice prior to the tabletop exercise as well as guidance that includes resulting expectations.
3. The exercise includes the four stages of the IRP: Preparation; Detection, Reporting, and Analysis; Containment, Eradication, and Recovery; and Post-Incident Follow-up.
Testing scenario
[Testing Scenario] Testing considerations
For purposes of this IRP test, this testing scenario will occur at [Testing Location]. The [APPLICATION ACRONYM] IRP will be used to determine activities and responses to the incident.
General Information
| 1 |
| Entity Name as listed in the GRC Tool: |
| [Application Name] |
| 2 |
| City, and State of IRP Test: |
| 3 |
| Date of Test: |
| 4 |
| Date of Last Test: |
| 5 |
| Plan Tested: |
| Incident Response Plan Test |
| 6 |
| Type of Test: |
| FORMCHECKBOX |
Tabletop
| 7 |
| Participants (include name, title, and IRP role): |
| Include all individuals participating in the tabletop test |
· [Name, Title, and IRP Role]
· [Name, Title, and IRP Role]
Preparation Stage
Tabletop test questions to ensure [APPLICATION ACRONYM] is prepared to respond to an incident.
| 8 |
| Was the IRP distributed to all incident response personnel containing incident response procedures and roles and responsibilities? (If yes, state how. If no, state reason why.) |
| FORMCHECKBOX |
Yes
FORMCHECKBOX
No
| 9 |
| Was an Incident Notification Contact List developed? (If yes, indicate by whom and where is it located. If no, state reason why.) |
| FORMCHECKBOX |
Yes
| 10 |
| Was an **Exercise** PSETS ticket opened to document the incident? This is required during the test in order to satisfy control IR-2.E02. |
| Send an email to VA CSOC Incident Handling VACSOCIncidentHandling@va.gov and in the Subject line also enter *** Exercise ***. |
Enter the following information in the body of the email: First Name, Last Name, Telephone, Facility Name (as shown in PSETS), and a description of the incident.
Detection, Reporting, and Analysis Stage
Tabletop test questions to ensure [APPLICATION ACRONYM] personnel can identify, report, and analyze incidents and activate the IRP.
| 11 |
| Is it agreed by all incident response personnel the scenario is an actual incident? Why or why not? (If yes, indicate the type of incident.) |
| FORMCHECKBOX |
Yes
| 12 |
| What questions should be asked of the employee that discovered the incident? (Record highlights of the discussion.) |
| When was this limit noticed to be incorrectly registered? |
What is the business impact?
| 13 |
| Did the ISO or PO know how to submit a PSETS ticket to the VA CSOC (and the appropriate timeframe to do so)? (If yes, record overview of the submission process. If no, state reason(s) why.) |
| FORMCHECKBOX |
Yes
| 14 |
| Assuming the VA CSOC determines this to be a privacy incident, who activates the IRP? |
| If, it is determined to be a Privacy incident, then the Incident response team is activated by namely the hospital director or designee. The IRT includes ISO/PO, FCIO, Chief Police, Director staff, HR, and Patient Advocate staff. |
| 15 |
| Once the [APPLICATION ACRONYM] IRP is activated, which personnel will be contacted? (Record highlights of discussion.) |
| ISO (Cyber security violations) or PO (Privacy violations) depending on the type of incident. The IRT will contact the affected service chief for further action and work with any additional authorities required to support investigation such as OIG, VA Police, OGC, etc. If the specific incident is OIT related, the ISO contacts OIT Incident Response Team consisting of OIT staff for remediation and resolution. The ISO updates VA CSOC with the final remediation and after-action report along with CSOC ticket updates as required every 72 hours. |
| 16 |
| Was all personnel contact information accurate on the Incident Notification Contact List? Were all personnel correctly listed in the roles as indicated? (If no, state reason why.) |
| FORMCHECKBOX |
Yes
Containment, Eradication, and Recovery
Tabletop test questions to ensure [APPLICATION ACRONYM] can contain the potential magnitude and damage caused by the incident.
| 17 |
| Who receives communication(s) from the [APPLICATION ACRONYM] for instructions? Who is responsible for completing these instructions? Who verifies [APPLICATION ACRONYM] implementation? (Record highlights of discussion.) |
| 18 |
| Based upon the scenario, identify possible recovery procedures that may be required of [APPLICATION ACRONYM] incident response personnel to reconstitute and restore operational status? (Record highlights of discussion.) |
| 19 |
| If recovery procedures are identified by [APPLICATION ACRONYM] prior to the VA CSOC, to whom are these procedures submitted for approval? Who submits them? |
| The ISO/PO as applicable |
| 20 |
| Once the instructions for recovery have been completed, who is contacted to report the recovery/operational status of [APPLICATION ACRONYM]? Who submits this final status? |
Post-Incident Follow-up
Tabletop test questions to ensure [APPLICATION ACRONYM] conducts post-incident follow-up.
| 21 |
| Is a “Lessons Learned” with input from all incident response team members captured? (If no, state reason why.) |
| FORMCHECKBOX |
Yes
| 22 |
| Are updates recommended to [APPLICATION ACRONYM] IRP based upon a “Lessons Learned” review? (If no, state reasons why.) |
| FORMCHECKBOX |
Yes
| 23 |
| Objectives: |
| · Objective #1: Verify [APPLICATION ACRONYM] is prepared to respond to an incident. |
· Objective #2: Demonstrate an understanding of the IRP stages of Preparation; Detection, Reporting, and Analysis; Containment, Eradication, and Recovery; and Post-Incident Follow-up by [APPLICATION ACRONYM] incidence response personnel.
· Objective #3: Verify the specified time-period and process for submitting the PSETS ticket to the VA CSOC.
· Objective #4: Validate personnel on the Incident Notification Contact List are the appropriate personnel and that their contact information is correct.
· Objective #5: Verify that the Area Manager coordinates with VA-level entities and advises on containment procedures and that the hardware/software involved in the incident is safeguarded appropriately.
· Objective #6: Identify [APPLICATION ACRONYM] recovery steps that may be required for the stated test scenario.
· Objective #7: Validate that the processes and procedures of IRP testing have been documented, and that the recommended updates to be made to the IRP are captured as “Lessons Learned.”
| 24 |
| Were all the test objectives met? (If no, which were not met and why?) |
| FORMCHECKBOX |
Yes
| 25 |
| Was a copy of the IRP test uploaded to the GRC Tool documents section and controls IR-02.1 and IR-2.E01? Was a copy of the completed PSET Test Ticket uploaded to control IR-2.E02? |
| FORMCHECKBOX |
Yes
| 26 |
| NIST SP 800-53 Rev. 4 Incident Response (IR) |
| The test exercise supports testing of IR-1, IR-2, IR-3, IR-4, IR-5, IR-6, IR-7, and IR-8 of the NIST IR family of controls. |
| 27 |
| Comments: |
| 28 |
| Lessons Learned: |
| 29 |
| Corrective Actions: |
Signature Page
[Name] [Title] IRP Test Observer
_1390994404.doc
File details come from the government source that posted it. Updated .