ABCD
1
2
3
SECURITY QUESTIONNAIRE
4
CATEGORY: INCIDENT AND CHANGE MANAGEMENT
5
6
7
PC.6.1Please supply the organization's most recent Incident Response Plan, or provide a description of those procedures.
9
PC.6.2Are all security incidents logged, tracked, and communicated to affected parties by management until resolved?
11
PC.6.3Please supply the organization's most recent Change Management Policy, or provide a description of the organization's change management procedures.
13
PC.6.4Are emergency changes authorized and documented (including after the fact approval)?
15
PC.6.5Are upgrades or system changes installed during off-peak hours or in a manner that does not impact performance?
17
PC.6.6How will customers be notified of major changes to the organization's environment that could impact the customer's security posture?
19
20
21
22
23
24
25
26
27