3.5.2 The incident response procedures shall include the following stages: (a) incident containment, to …

Requirement

The incident response procedures shall include the following stages: (a) incident containment, to prevent the consequences of the incident from spreading; (b) eradication, to prevent the incident from continuing or reappearing, (c) recovery from the incident, where necessary.

Guidance

• Create incident response procedures outlining the steps referred to in point 3.5.2 of the Annex to the regulation.
• Ensure that the handling of cybersecurity incidents takes into account the entity’s priorities and the impact of the incident.
  • Recognize and address potential conflicts between the following objectives during incident handling:
    • forensic activities – preserving and securing evidence for legal, compliance or investigative purposes,
    • incident response activities – mitigating and removing current threats to prevent further damage and
    • operational continuity – minimizing disruption to IT services and maintaining critical operations.
  • Where these objectives conflict, establish a clear decision-making process that:
    • prioritises based on the accepted risk tolerance levels, business impact and legal obligations,
    • involves coordination between cybersecurity, legal/compliance and operational teams and
    • documents the rationale for prioritisation decisions to ensure transparency and accountability.
  • Develop incident response playbooks that incorporate decision making and escalation paths for managing trade-offs between evidence preservation, threat containment and operational continuity.
• Keep the management bodies informed.

Examples of evidence

• Procedures for incident response, including types of incidents that could occur, objectives, roles and responsibilities. Detailed description, for each incident type, of how to manage the incident and when to escalate to management bodies (e.g. chief information security officer), etc.
• Records from resolution of conflicting objectives during response to past incidents.

1. Panoramica

1.1 Riferimenti

1.2 Requisiti identificati

1.3 Regolamentazioni correlate

2. Requisiti identificati

3. Regolamentazioni correlate

Ticket collegati

• ENISA -