RS.CO Incident Response Reporting and Communication

Statement

Personnel know their roles and order of operations when a response is needed

Statement

Internal and external stakeholders are notified of incidents

Guidance

Follow the organization's breach notification procedures after discovering a data breach incident, including notifying affected customers

Guidance

Notify business partners and customers of incidents in accordance with contractual requirements

Guidance

Notify law enforcement agencies and regulatory bodies of incidents based on criteria in the incident response plan and management approval

Statement

Information is shared with designated internal and external stakeholders

Guidance

Securely share information consistent with response plans and information sharing agreements

Guidance

Voluntarily share information about an attacker's observed TTPs, with all sensitive data removed, with an Information Sharing and Analysis Center (ISAC)

Guidance

Notify HR when malicious insider activity occurs

Guidance

Regularly update senior leadership on the status of major incidents

Guidance

Follow the rules and protocols defined in contracts for incident information sharing between the organization and its suppliers

Guidance

Coordinate crisis communication methods between the organization and its critical suppliers

Statement

Coordination with stakeholders occurs consistent with response plans

Statement

Voluntary information sharing occurs with external stakeholders to achieve broader cybersecurity situational awareness