+RS RESPOND
---+RS.AN Incident Analysis
------+RS.AN-01 Notifications from detection systems are investigated
------+RS.AN-02 The impact of the incident is understood
------+RS.AN-03 Analysis is performed to establish what has taken place during an incident and the root cause of the incident
------+RS.AN-04 Incidents are categorized consistent with response plans
------+RS.AN-05 Processes are established to receive, analyze and respond to vulnerabilities disclosed to the organization from internal and external sources (e.g. …
------+RS.AN-06 Actions performed during an investigation are recorded, and the records' integrity and provenance are preserved
------+RS.AN-07 Incident data and metadata are collected, and their integrity and provenance are preserved
------+RS.AN-08 An incident's magnitude is estimated and validated
---+RS.CO Incident Response Reporting and Communication
------+RS.CO-01 Personnel know their roles and order of operations when a response is needed
------+RS.CO-02 Internal and external stakeholders are notified of incidents
------+RS.CO-03 Information is shared with designated internal and external stakeholders
------+RS.CO-04 Coordination with stakeholders occurs consistent with response plans
------+RS.CO-05 Voluntary information sharing occurs with external stakeholders to achieve broader cybersecurity situational awareness
---+RS.IM Improvements
------+RS.IM-01 Response plans incorporate lessons learned
------+RS.IM-02 Response strategies are updated
---+RS.MA Incident Management
------+RS.MA-01 The incident response plan is executed in coordination with relevant third parties once an incident is declared
------+RS.MA-02 Incident reports are triaged and validated
------+RS.MA-03 Incidents are categorized and prioritized
------+RS.MA-04 Incidents are escalated or elevated as needed
------+RS.MA-05 The criteria for initiating incident recovery are applied
---+RS.MI Incident Mitigation
------+RS.MI-01 Incidents are contained
------+RS.MI-02 Incidents are eradicated
------+RS.MI-03 Newly identified vulnerabilities are mitigated or documented as accepted risks
---+RS.RP Response Planning
------+RS.RP-01 Response plan is executed during or after an incident

RS RESPOND

RESPOND

Actions regarding a detected cybersecurity incident are taken

1. Přehled

RS.AN Incident Analysis

Statement

Investigations are conducted to ensure effective response and support forensics and recovery activities
RS.CO Incident Response Reporting and Communication

Statement

Response activities are coordinated with internal and external stakeholders as required by laws, regulations, or policies
RS.IM Improvements

Statement
RS.MA Incident Management

Statement

Responses to detected cybersecurity incidents are managed
RS.MI Incident Mitigation

Statement

Activities are performed to prevent expansion of an event and mitigate its effects
RS.RP Response Planning

Statement

1.1 Odkazy

1.2 Identifikované požadavky

1.3 Související regulace

2. Identifikované požadavky

Požadavky

3. Související regulace

Regulace

Propojené úkoly

Vazby
is blocked by Incident Response Operations
is blocked by Incident Handling
is blocked by Incident Response Plan (IRP)
is blocked by Integrated Security Incident Response Team (ISIRT)
is blocked by Incident Stakeholder Reporting
is blocked by Situational Awareness For Incidents