RS.MI Incident Mitigation

Statement

Incidents are contained

Example

Cybersecurity technologies (e.g., antivirus software) and cybersecurity features of other technologies (e.g., operating systems, network infrastructure devices) automatically perform containment actions

Example

Allow incident responders to manually select and perform containment actions

Example

Allow a third party (e.g., internet service provider, managed security service provider) to perform containment actions on behalf of the organization

Example

Automatically transfer compromised endpoints to a remediation virtual local area network (VLAN)

Statement

Incidents are eradicated

Example

Cybersecurity technologies and cybersecurity features of other technologies (e.g., operating systems, network infrastructure devices) automatically perform eradication actions

Example

Allow incident responders to manually select and perform eradication actions

Example

Allow a third party (e.g., managed security service provider) to perform eradication actions on behalf of the organization

Statement

Newly identified vulnerabilities are mitigated or documented as accepted risks