5.1.2.1
Incident Response Plan
Incident Response Plan for Varying Severity
The organization shall have an incident response plan for how to respond to different types of incidents of varying severity. If an organization is unable to manage some types of incidents on its own, the organization shall have a plan for what it will do.
-
5.6 Contact With Special Interest Groups: The organization must connect with specialized security groups and professional associations.
5.7 Threat Intelligence: Collect and analyze information security threats for threat intelligence.
5.24 Information Security Incident Management Planning and Preperation: Plan for managing security incidents by defining and communicating processes, roles, and responsibilities.
5.25 Assessment and Decision on Information Security Events: The organization should evaluate information security events to determine if they qualify as security incidents.
5.26 Response to Information Security Incidnets: Respond to information security incidents as per the documented procedures.
5.27 Learning From Information Security Incidents: Insights from security incidents should be used to enhance and refine information security measures.
5.28 Collection of Evidence: The organization should develop and enforce procedures to identify, gather, acquire, and preserve evidence pertaining to information security events.
5.29 Information Security During Disruption: The organization should strategize to uphold information security at a suitable level during disruptions.
-
3.2.2 Ensure that personnel are trained to carry out their assigned information security-related duties and responsibilities.
3.6.1 Establish an operational incident-handling capability for organizational systems that includes preparation, detection, analysis, containment, recovery, and user response activities.
3.6.2 Track, document, and report incidents to designated officials and/or authorities both internal and external to the organization.
3.6.3 Test the organizational incident response capability.
-
3.2.2 Ensure that personnel are trained to carry out their assigned information security-related duties and responsibilities.
3.6.1 Establish an operational incident-handling capability for organizational systems that includes preparation, detection, analysis, containment, recovery, and user response activities.
3.6.2 Track, document, and report incidents to designated officials and/or authorities both internal and external to the organization.
3.6.3 Test the organizational incident response capability.