3.5.5 The relevant entities shall test at planned intervals their incident response procedures.

Requirement

The relevant entities shall test at planned intervals their incident response procedures.

Guidance

• Test the entity’s incident response procedures at least annually.
• Test different types of incidents, for example ransomware, phishing, data breach and DoS.
• Ensure that test scenarios involve employees from different departments as well as external stakeholders, for example suppliers and service providers.
  • Where necessary, include management bodies in the tests so that they understand their role during an incident.
• Conduct post-test reviews for possible lessons learnt.
• Update the incident response procedures based on the lessons learnt from the test, if applicable.

Examples of evidence

• Documented plans or schedules for future incident response tests.
• Records from tests of different types of incidents.

Tips: guidance

• Issue instructions on how to respond to the most common types of incidents (ransomware, phishing, data breach, DoS, etc.) including containment, eradication and recovery steps.
• Include guidelines for preserving evidence and maintaining chain of custody to support forensic analysis and legal proceedings if necessary.
• Consider the use of automated solutions for incident response, for example security orchestration, automation and response technologies or similar systems.

Tips: examples of evidence

• Up-to-date incident response procedures based on tests conducted and/or change logs.

1. Panoramica

1.1 Riferimenti

1.2 Requisiti identificati

1.3 Regolamentazioni correlate

2. Requisiti identificati

3. Regolamentazioni correlate

Ticket collegati

• ENISA -

  EN: Publications of the European Union Agency for Cybersecurity (ENISA), https://www.enisa.europa.eu/. © European Union Agency for Cybersecurity (ENISA). Unless otherwise noted, licensed under CC BY 4.0. Changes: divided into sections, converted into the GRCA format and linked to the EU legal acts they refer to; images and material of third parties are not reproduced. Only the versions published by ENISA are authoritative.

  DE: Veröffentlichungen der Agentur der Europäischen Union für Cybersicherheit (ENISA), https://www.enisa.europa.eu/. © European Union Agency for Cybersecurity (ENISA). Soweit nicht anders vermerkt, lizenziert unter CC BY 4.0. Änderungen: in Abschnitte aufgeteilt, in das GRCA-Format umgewandelt und mit den EU-Rechtsakten verknüpft, auf die sie sich beziehen; Bilder und Material Dritter werden nicht wiedergegeben. Maßgeblich sind allein die von der ENISA veröffentlichten Fassungen.