Wherever possible, ensure that Red Teams results are documented using open, machine-readable standards (e.g., SCAP). Devise a scoring method for determining the results of Red Team exercises so that results can be compared over time.
NOTE FOR CONTROLS TEAM: Another dual-ask. 1) use open, machine-readable documentation standards, 2) devise a scoring method so results can be compared over time.
Inputs:
ERTP: Enterprise red team policy
Latest red team result documentation
Operations:
Examine the enterprise red team policy for the following properties:
Red team documentation is machine-readable
Red team documentation is based on open specification
Red team results must be scored to support ongoing comparison
Examine the latest red team results documentation to verify
Documentation is machine-readable
Documentation is based on open specification
Current score was compared to previous score
Measures:
M1 = Boolean - Policy demands machine-readable red team results documentation (1) or not (0)
M2 = Boolean - Policy demands open specification for machine-readable results (1) or not (0)
M3 = Boolean - Policy demands results to be scored to support ongoing comparison (1) or not (0)
M4 = Boolean - Last red team results are machine-readable (1) or not (0)
M5 = Boolean - Last red team results are based on an open specification (1) or not (0)
M6 = Boolean - Last red team results includes current and previous score for comparison (1) or not (0); in the event the current score is the result of the enterprise's first red team exercise, this can be set to (1).
Metrics:
M1 AND M2 AND M3 = Policy is conformant with this sub-control.
M4 AND M5 AND M6 = Policy is being practiced operationally
Wherever possible, ensure that Red Teams results are documented using open, machine-readable standards (e.g., SCAP). Devise a scoring method for determining the results of Red Team exercises so that results can be compared over time.
Measures
Metrics