3.2.1 and record evidence.

Requirement

and record evidence.

Guidance

• Log incident response information which contains (indicative, non-exhaustive list):
  • time of detection, containment and eradication;
  • when the systems recovered;
  • indicators of compromise;
  • root cause;
  • actions taken during each phase namely, detection, containment and eradication;
  • assessment of the scope and the level of impact of the incident;
  • communications when responding to the incident;
  • post incident lessons learnt and recommendations; and
  • whether the CSIRT or the competent authority was notified of the incident according to the NIS2 Directive Articles 23 and 30.

Examples of evidence

• Logs from incident response.
• Use of a system (e.g. SIEM, EDR/XDR or ticket system).

1. Overview

1.1 References

1.2 Identified Requirements

1.3 Related Regulations

2. Identified Requirements

3. Related Regulations

Linked Issues

• ENISA -

  EN: Publications of the European Union Agency for Cybersecurity (ENISA), https://www.enisa.europa.eu/. © European Union Agency for Cybersecurity (ENISA). Unless otherwise noted, licensed under CC BY 4.0. Changes: divided into sections, converted into the GRCA format and linked to the EU legal acts they refer to; images and material of third parties are not reproduced. Only the versions published by ENISA are authoritative.

  DE: Veröffentlichungen der Agentur der Europäischen Union für Cybersicherheit (ENISA), https://www.enisa.europa.eu/. © European Union Agency for Cybersecurity (ENISA). Soweit nicht anders vermerkt, lizenziert unter CC BY 4.0. Änderungen: in Abschnitte aufgeteilt, in das GRCA-Format umgewandelt und mit den EU-Rechtsakten verknüpft, auf die sie sich beziehen; Bilder und Material Dritter werden nicht wiedergegeben. Maßgeblich sind allein die von der ENISA veröffentlichten Fassungen.