Incident Response

Untervorgänge

Verknüpfungen
Loss of Investigative / Evidentiary Capability Required evidence, logs, records or chain-of-custody integrity are unavailable or unreliable that prevents the organization from reliably:
(1) Reconstructing;
(2) Investigating;
(3) Attributing / taking legal action for; and/or
(4) Learning from an incident.
Delayed Containment / Increased Incident Impact An incident is not contained, eradicated, communicated or escalated in a timely and appropriate manner, allowing the scope, duration, cost and/or harm of the incident to increase.
Incident Persistence / Recurrence Root causes, persistence mechanisms or affected conditions are not effectively remediated, allowing the incident, vulnerability or compromise to continue or recur.
Incident Response / Recovery Cost The organization incurs unplanned investigation, containment, recovery, notification, legal, forensic, restoration and/or other costs associated with managing an incident or loss event.
Loss of Investigative / Evidentiary Capability Required evidence, logs, records or chain-of-custody integrity are unavailable or unreliable that prevents the organization from reliably:
(1) Reconstructing;
(2) Investigating;
(3) Attributing / taking legal action for; and/or
(4) Learning from an incident.
Delayed Containment / Increased Incident Impact An incident is not contained, eradicated, communicated or escalated in a timely and appropriate manner, allowing the scope, duration, cost and/or harm of the incident to increase.
Incident Persistence / Recurrence Root causes, persistence mechanisms or affected conditions are not effectively remediated, allowing the incident, vulnerability or compromise to continue or recur.
Incident Response / Recovery Cost The organization incurs unplanned investigation, containment, recovery, notification, legal, forensic, restoration and/or other costs associated with managing an incident or loss event.
Loss of Investigative / Evidentiary Capability Required evidence, logs, records or chain-of-custody integrity are unavailable or unreliable that prevents the organization from reliably:
(1) Reconstructing;
(2) Investigating;
(3) Attributing / taking legal action for; and/or
(4) Learning from an incident.
Delayed Containment / Increased Incident Impact An incident is not contained, eradicated, communicated or escalated in a timely and appropriate manner, allowing the scope, duration, cost and/or harm of the incident to increase.
Incident Persistence / Recurrence Root causes, persistence mechanisms or affected conditions are not effectively remediated, allowing the incident, vulnerability or compromise to continue or recur.
Incident Response / Recovery Cost The organization incurs unplanned investigation, containment, recovery, notification, legal, forensic, restoration and/or other costs associated with managing an incident or loss event.
Loss of Investigative / Evidentiary Capability Required evidence, logs, records or chain-of-custody integrity are unavailable or unreliable that prevents the organization from reliably:
(1) Reconstructing;
(2) Investigating;
(3) Attributing / taking legal action for; and/or
(4) Learning from an incident.
Delayed Containment / Increased Incident Impact An incident is not contained, eradicated, communicated or escalated in a timely and appropriate manner, allowing the scope, duration, cost and/or harm of the incident to increase.
Incident Persistence / Recurrence Root causes, persistence mechanisms or affected conditions are not effectively remediated, allowing the incident, vulnerability or compromise to continue or recur.
Incident Response / Recovery Cost The organization incurs unplanned investigation, containment, recovery, notification, legal, forensic, restoration and/or other costs associated with managing an incident or loss event.