ID.IM-04 Incident response plans and other cybersecurity plans that affect operations are established, communicated, maintained, and improved

Statement

Incident response plans and other cybersecurity plans that affect operations are established, communicated, maintained, and improved

Guidance

Establish contingency plans (e.g., incident response, business continuity, disaster recovery) for responding to and recovering from adverse events that can interfere with operations, expose confidential information, or otherwise endanger the organization's mission and viability

Guidance

Include contact and communication information, processes for handling common scenarios, and criteria for prioritization, escalation, and elevation in all contingency plans

Guidance

Create a vulnerability management plan to identify and assess all types of vulnerabilities and to prioritize, test, and implement risk responses

Guidance

Communicate cybersecurity plans (including updates) to those responsible for carrying them out and to affected parties

Guidance

Review and update all cybersecurity plans annually or when a need for significant improvements is identified

1. Overview

1.1 References

• 1.1 Policy on the security of network and information systems
• 1.2 Roles, responsibilities and authorities
• 2.1 Risk management framework
• 2.2 Compliance monitoring
• 2.2 and the monitoring and measurement pursuant to point 7, shall be reported to the management bodies. …
• 3.1 Incident handling policy
• 3.2 Monitoring and logging
• 3.4 Event assessment and classification
• 3.5 Incident response
• 3.6 Post-incident reviews
• 4.1 Business continuity and disaster recovery plan
• 5.1 Supply chain security policy
• 5.2 Directory of suppliers and service providers
• 6.1 Security in acquisition of ICT services or ICT products
• 6.2 Secure development life cycle
• 6.3 Configuration management
• 6.4 Change management, repairs and maintenance
• 6.5 Security testing
• 6.6 Security patch management
• 6.7 Network security
• 6.8 Network segmentation
• 6.9 Protection against malicious and unauthorised software
• 6.10 Vulnerability handling and disclosure
• 7.1 For the purpose of Article 21(2), point (f) of Directive (EU) 2022/2555, the relevant entities …
• 8.1 Awareness raising and basic cyber hygiene practices
• 8.2 Security training
• 9.1 For the purpose of Article 21(2), point (h) of Directive (EU) 2022/2555, the relevant entities …
• 10.1 Human resources security
• 10.2 Verification of background
• 10.4 Disciplinary process
• 11.1 Access control policy
• 11.2 Management of access rights
• 11.3 Privileged accounts and system administration accounts
• 11.6 Authentication
• 12.3 Removable media policy
• 12.4 Asset inventory
• 13.1 Supporting utilities
• 13.2 Protection against physical and environmental threats

1.2 Identified Requirements

1.3 Related Regulations

2. Identified Requirements

3. Related Regulations

Linked Issues

• NIST -

  EN: Publications of the National Institute of Standards and Technology (NIST), U.S. Department of Commerce, https://www.nist.gov/, from their electronic versions (OSCAL; SP 800-63-4 from its HTML version, https://pages.nist.gov/800-63-4/). Works of NIST employees are not subject to copyright protection in the United States (17 U.S.C. § 105); the OSCAL content is dedicated to the public domain worldwide (CC0 1.0); outside the United States NIST grants the right to reprint its technical series publications in all formats (NIST copyright statement). Republished courtesy of the National Institute of Standards and Technology; each document names its citation. Divided into sections and converted into the GRCA format, the wording unchanged. Only the versions published by NIST are authoritative.

  DE: Veröffentlichungen des National Institute of Standards and Technology (NIST), U.S. Department of Commerce, https://www.nist.gov/, aus ihren elektronischen Fassungen (OSCAL; SP 800-63-4 aus ihrer HTML-Fassung, https://pages.nist.gov/800-63-4/). Werke von NIST-Beschäftigten sind in den USA urheberrechtlich nicht geschützt (17 U.S.C. § 105); die OSCAL-Inhalte sind weltweit gemeinfrei gestellt (CC0 1.0); außerhalb der USA räumt das NIST das Recht ein, seine Technical-Series-Publikationen in allen Formaten neu zu veröffentlichen (Copyright-Hinweis des NIST). „Republished courtesy of the National Institute of Standards and Technology“; jedes Dokument nennt seine Zitierangabe. In Abschnitte aufgeteilt und in das GRCA-Format umgewandelt, der Wortlaut unverändert. Maßgeblich sind allein die vom NIST veröffentlichten Fassungen.