3.5.5 The relevant entities shall test at planned intervals their incident response procedures.

Requirement

The relevant entities shall test at planned intervals their incident response procedures.

Guidance

• Test the entity’s incident response procedures at least annually.
• Test different types of incidents, for example ransomware, phishing, data breach and DoS.
• Ensure that test scenarios involve employees from different departments as well as external stakeholders, for example suppliers and service providers.
  • Where necessary, include management bodies in the tests so that they understand their role during an incident.
• Conduct post-test reviews for possible lessons learnt.
• Update the incident response procedures based on the lessons learnt from the test, if applicable.

Examples of evidence

• Documented plans or schedules for future incident response tests.
• Records from tests of different types of incidents.

Tips: guidance

• Issue instructions on how to respond to the most common types of incidents (ransomware, phishing, data breach, DoS, etc.) including containment, eradication and recovery steps.
• Include guidelines for preserving evidence and maintaining chain of custody to support forensic analysis and legal proceedings if necessary.
• Consider the use of automated solutions for incident response, for example security orchestration, automation and response technologies or similar systems.

Tips: examples of evidence

• Up-to-date incident response procedures based on tests conducted and/or change logs.

1. Преглед

1.1 Препратки

1.2 Идентифицирани изисквания

1.3 Свързани регулации

2. Идентифицирани изисквания

3. Свързани регулации

Свързани задачи

• ENISA -