3.2.1 and record evidence.

Requirement

and record evidence.

Guidance

• Log incident response information which contains (indicative, non-exhaustive list):
  • time of detection, containment and eradication;
  • when the systems recovered;
  • indicators of compromise;
  • root cause;
  • actions taken during each phase namely, detection, containment and eradication;
  • assessment of the scope and the level of impact of the incident;
  • communications when responding to the incident;
  • post incident lessons learnt and recommendations; and
  • whether the CSIRT or the competent authority was notified of the incident according to the NIS2 Directive Articles 23 and 30.

Examples of evidence

• Logs from incident response.
• Use of a system (e.g. SIEM, EDR/XDR or ticket system).

1. Forbhreathnú

1.1 Tagairtí

1.2 Ceanglais aitheanta

1.3 Rialacháin ghaolmhara

2. Ceanglais aitheanta

3. Rialacháin ghaolmhara

Saincheisteanna nasctha

• ENISA -