simpl.
تسجيل الدخول
حوكمة ومخاطر وامتثال الأمن السيبراني (GRC) 14 بند

Breach & Attack Simulation / Purple-Team Exercise

قائمة التحقق هذه باللغة الإنجليزية.

Evaluates a breach-and-attack-simulation and purple-team program covering scoping, adversary emulation, detection validation, collaboration, and remediation.

MITRE ATT&CKNIST 800-53CIS

PDF أو Word مجانًا · أدخل بريدك الإلكتروني للتنزيل.

Scoping & Planning

  • Are exercise objectives and success criteria defined with stakeholder agreement? *
  • Are the threat scenarios based on relevant adversary TTPs and threat intelligence? *
  • Are rules of engagement, scope boundaries, and safety controls documented and approved? *
  • Is the target environment (production vs. staging) and blast radius agreed in advance? *

Execution

  • Are simulations mapped to specific MITRE ATT&CK techniques across the kill chain? *
  • For purple-team exercises, do red and blue teams collaborate in real time? *
  • Is safe, non-destructive tooling used with continuous monitoring for adverse impact? *
  • Are both preventive and detective controls exercised (not just endpoint)?

Validation & Measurement

  • Is prevention/detection efficacy measured per technique (blocked, alerted, missed)? *
  • Is detection coverage tracked as a percentage of tested techniques?
  • Are detection and response times (MTTD/MTTR) captured during the exercise?

Remediation & Continuous Improvement

  • Are gaps documented with owners and remediation timelines? *
  • Are new or tuned detections created for missed techniques? *
  • Are exercises run on a recurring cadence to measure improvement over time?

نزّل قائمة تحقق Breach & Attack Simulation / Purple-Team Exercise كاملة

احصل عليها مجانًا بصيغة PDF أنيقة قابلة للطباعة أو مستند Word قابل للتعديل.