03.06.01 Incident Handling

Statement

Implement an incident-handling capability that is consistent with the incident response plan and includes preparation, detection and analysis, containment, eradication, and recovery.

Guidance

Incident-related information can be obtained from a variety of sources, including audit monitoring, network monitoring, physical access monitoring, user and administrator reports, and reported supply chain events. An effective incident handling capability involves coordination among many organizational entities, including mission and business owners, system owners, human resources offices, physical and personnel security offices, legal departments, operations personnel, and procurement offices.

Assessment objective

an incident-handling capability that is consistent with the incident response plan is implemented.

Assessment objective

the incident handling capability includes preparation.

Assessment objective

the incident handling capability includes detection and analysis.

Assessment objective

the incident handling capability includes containment.

Assessment objective

the incident handling capability includes eradication.

Assessment objective

the incident handling capability includes recovery.

Assessment method

• incident response policy and procedures contingency planning policy and procedures procedures for incident handling procedures for incident response planning incident response plan contingency plan records of incident response plan reviews and approvals system security plan other relevant documents or records

Assessment method

• personnel with incident handling responsibilities personnel with incident response planning responsibilities personnel with contingency planning responsibilities personnel with information security responsibilities

Assessment method

• incident handling capability for the organization incident response plan

1. Přehled

1.1 Odkazy

1.2 Identifikované požadavky

1.3 Související regulace

2. Identifikované požadavky

3. Související regulace

Propojené úkoly

• NIST -

  https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final