NIST SP 800-115 (Technical Guide to Information Security Testing and Assessment)
Planning
NIST SP 800-115 (Technical Guide to Information Security Testing and Assessment) 1: Scope, Methodology, and Assessment Planning
Apply NIST SP 800-115 Technical Guide to Information Security Testing and Assessment published September 2008 + still operative for security testing methodology + complement to NIST SP 800-53A + NIST SP 800-30. Define assessment scope + objectives + roles and responsibilities + rules of engagement (RoE) per Section 2 and Section 3.1 including type of testing (review + identification + validation) + targets + boundaries + sensitivity + impact assessment + escalation procedures + assessment plan documentation. Coordinate with risk management framework + system owner + system security officer + ISSO + CISO + authorising official.
What else in your programme already covers this
This control maps to 191 controls across 98 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
NIST-CSF-DE.AE-08 Incidents are declared when adverse events meet the defined incident criteria
NIST-CSF-PR.AA-05 Access permissions, entitlements, and authorizations are defined in a policy, managed, enforced, and reviewed, and incorporate the principles of least privilege and separation of duties
2.2.2 Vendor default accounts are managed as follows: • If the vendor default account(s) will be used, the default password is changed per Requirement 8.3.6. • If the vendor default account(s) will not be used,