+RS RESPOND
---+RS.AN Incident Analysis
------+RS.AN-01 Notifications from detection systems are investigated
------+RS.AN-02 The impact of the incident is understood
------+RS.AN-03 Analysis is performed to establish what has taken place during an incident and the root cause of the incident
------+RS.AN-04 Incidents are categorized consistent with response plans
------+RS.AN-05 Processes are established to receive, analyze and respond to vulnerabilities disclosed to the organization from internal and external sources (e.g. …
------+RS.AN-06 Actions performed during an investigation are recorded, and the records' integrity and provenance are preserved
------+RS.AN-07 Incident data and metadata are collected, and their integrity and provenance are preserved
------+RS.AN-08 An incident's magnitude is estimated and validated
---+RS.CO Incident Response Reporting and Communication
------+RS.CO-01 Personnel know their roles and order of operations when a response is needed
------+RS.CO-02 Internal and external stakeholders are notified of incidents
------+RS.CO-03 Information is shared with designated internal and external stakeholders
------+RS.CO-04 Coordination with stakeholders occurs consistent with response plans
------+RS.CO-05 Voluntary information sharing occurs with external stakeholders to achieve broader cybersecurity situational awareness
---+RS.IM Improvements
------+RS.IM-01 Response plans incorporate lessons learned
------+RS.IM-02 Response strategies are updated
---+RS.MA Incident Management
------+RS.MA-01 The incident response plan is executed in coordination with relevant third parties once an incident is declared
------+RS.MA-02 Incident reports are triaged and validated
------+RS.MA-03 Incidents are categorized and prioritized
------+RS.MA-04 Incidents are escalated or elevated as needed
------+RS.MA-05 The criteria for initiating incident recovery are applied
---+RS.MI Incident Mitigation
------+RS.MI-01 Incidents are contained
------+RS.MI-02 Incidents are eradicated
------+RS.MI-03 Newly identified vulnerabilities are mitigated or documented as accepted risks
---+RS.RP Response Planning
------+RS.RP-01 Response plan is executed during or after an incident

RS RESPOND

RESPOND

Actions regarding a detected cybersecurity incident are taken

1. Panoramica

Titolo Standard
RS.AN Incident Analysis

Statement

Investigations are conducted to ensure effective response and support forensics and recovery activities

RS.CO Incident Response Reporting and Communication

Statement

Response activities are coordinated with internal and external stakeholders as required by laws, regulations, or policies

RS.IM Improvements

Statement

RS.MA Incident Management

Statement

Responses to detected cybersecurity incidents are managed

RS.MI Incident Mitigation

Statement

Activities are performed to prevent expansion of an event and mitigate its effects

RS.RP Response Planning

Statement

1.1 Riferimenti

1.2 Requisiti identificati

1.3 Regolamentazioni correlate

2. Requisiti identificati

Requisiti
Fonte Requisito

3. Regolamentazioni correlate

Regolamentazioni
Fonte Regolamentazione

Ticket collegati

  • NIST -

    EN: Publications of the National Institute of Standards and Technology (NIST), U.S. Department of Commerce, https://www.nist.gov/, from their electronic versions (OSCAL; SP 800-63-4 from its HTML version, https://pages.nist.gov/800-63-4/). Works of NIST employees are not subject to copyright protection in the United States (17 U.S.C. § 105); the OSCAL content is dedicated to the public domain worldwide (CC0 1.0); outside the United States NIST grants the right to reprint its technical series publications in all formats (NIST copyright statement). Republished courtesy of the National Institute of Standards and Technology; each document names its citation. Divided into sections and converted into the GRCA format, the wording unchanged. Only the versions published by NIST are authoritative.

    DE: Veröffentlichungen des National Institute of Standards and Technology (NIST), U.S. Department of Commerce, https://www.nist.gov/, aus ihren elektronischen Fassungen (OSCAL; SP 800-63-4 aus ihrer HTML-Fassung, https://pages.nist.gov/800-63-4/). Werke von NIST-Beschäftigten sind in den USA urheberrechtlich nicht geschützt (17 U.S.C. § 105); die OSCAL-Inhalte sind weltweit gemeinfrei gestellt (CC0 1.0); außerhalb der USA räumt das NIST das Recht ein, seine Technical-Series-Publikationen in allen Formaten neu zu veröffentlichen (Copyright-Hinweis des NIST). „Republished courtesy of the National Institute of Standards and Technology“; jedes Dokument nennt seine Zitierangabe. In Abschnitte aufgeteilt und in das GRCA-Format umgewandelt, der Wortlaut unverändert. Maßgeblich sind allein die vom NIST veröffentlichten Fassungen.