3.2.1 and record evidence.

Requirement

and record evidence.

Guidance

• Log incident response information which contains (indicative, non-exhaustive list):
  • time of detection, containment and eradication;
  • when the systems recovered;
  • indicators of compromise;
  • root cause;
  • actions taken during each phase namely, detection, containment and eradication;
  • assessment of the scope and the level of impact of the incident;
  • communications when responding to the incident;
  • post incident lessons learnt and recommendations; and
  • whether the CSIRT or the competent authority was notified of the incident according to the NIS2 Directive Articles 23 and 30.

Examples of evidence

• Logs from incident response.
• Use of a system (e.g. SIEM, EDR/XDR or ticket system).

1. Vue d’ensemble

1.1 Références

1.2 Exigences identifiées

1.3 Réglementations associées

2. Exigences identifiées

3. Réglementations associées

Tickets liés

• ENISA -