+3.5.5 The relevant entities shall test at planned intervals their incident response procedures.

3.5.5 The relevant entities shall test at planned intervals their incident response procedures.

Requirement

The relevant entities shall test at planned intervals their incident response procedures.

Guidance

  • Test the entity’s incident response procedures at least annually.
  • Test different types of incidents, for example ransomware, phishing, data breach and DoS.
  • Ensure that test scenarios involve employees from different departments as well as external stakeholders, for example suppliers and service providers.
    • Where necessary, include management bodies in the tests so that they understand their role during an incident.
  • Conduct post-test reviews for possible lessons learnt.
  • Update the incident response procedures based on the lessons learnt from the test, if applicable.

Examples of evidence

  • Documented plans or schedules for future incident response tests.
  • Records from tests of different types of incidents.

Tips: guidance

  • Issue instructions on how to respond to the most common types of incidents (ransomware, phishing, data breach, DoS, etc.) including containment, eradication and recovery steps.
  • Include guidelines for preserving evidence and maintaining chain of custody to support forensic analysis and legal proceedings if necessary.
  • Consider the use of automated solutions for incident response, for example security orchestration, automation and response technologies or similar systems.

Tips: examples of evidence

  • Up-to-date incident response procedures based on tests conducted and/or change logs.

1. Oversigt

1.1 Referencer

1.2 Identificerede krav

1.3 Relaterede reguleringer

2. Identificerede krav

Krav

3. Relaterede reguleringer

Reguleringer

Linkede sager

Sagslinks
is related to 3.5.5. De relevante enheder tester med planlagte mellemrum deres procedurer for reaktion på …
  • ENISA -

    EN: Publications of the European Union Agency for Cybersecurity (ENISA), https://www.enisa.europa.eu/. © European Union Agency for Cybersecurity (ENISA). Unless otherwise noted, licensed under CC BY 4.0. Changes: divided into sections, converted into the GRCA format and linked to the EU legal acts they refer to; images and material of third parties are not reproduced. Only the versions published by ENISA are authoritative.

    DE: Veröffentlichungen der Agentur der Europäischen Union für Cybersicherheit (ENISA), https://www.enisa.europa.eu/. © European Union Agency for Cybersecurity (ENISA). Soweit nicht anders vermerkt, lizenziert unter CC BY 4.0. Änderungen: in Abschnitte aufgeteilt, in das GRCA-Format umgewandelt und mit den EU-Rechtsakten verknüpft, auf die sie sich beziehen; Bilder und Material Dritter werden nicht wiedergegeben. Maßgeblich sind allein die von der ENISA veröffentlichten Fassungen.