Subcontrol 20.7

[adammontville]

Wherever possible, ensure that Red Teams results are documented using open, machine-readable standards (e.g., SCAP). Devise a scoring method for determining the results of Red Team exercises so that results can be compared over time.

Measures

None provided

Metrics

None provided

[adammontville]

NOTE FOR CONTROLS TEAM: Another dual-ask. 1) use open, machine-readable documentation standards, 2) devise a scoring method so results can be compared over time.

Inputs:

• ERTP: Enterprise red team policy
• Latest red team result documentation

Operations:

• Examine the enterprise red team policy for the following properties:
  • Red team documentation is machine-readable
  • Red team documentation is based on open specification
  • Red team results must be scored to support ongoing comparison
• Examine the latest red team results documentation to verify
  • Documentation is machine-readable
  • Documentation is based on open specification
  • Current score was compared to previous score

Measures:

• M1 = Boolean - Policy demands machine-readable red team results documentation (1) or not (0)
• M2 = Boolean - Policy demands open specification for machine-readable results (1) or not (0)
• M3 = Boolean - Policy demands results to be scored to support ongoing comparison (1) or not (0)
• M4 = Boolean - Last red team results are machine-readable (1) or not (0)
• M5 = Boolean - Last red team results are based on an open specification (1) or not (0)
• M6 = Boolean - Last red team results includes current and previous score for comparison (1) or not (0); in the event the current score is the result of the enterprise's first red team exercise, this can be set to (1).

Metrics:

• M1 AND M2 AND M3 = Policy is conformant with this sub-control.
• M4 AND M5 AND M6 = Policy is being practiced operationally