+IR-04(11) [H] Integrated Incident Response Team
|
IR-04(11) [H] Integrated Incident Response Team
Control
Establish and maintain an integrated incident response team that can be deployed to any location identified by the organization in [Assignement: time period].
Discussion
An integrated incident response team is a team of experts that assesses, documents, and responds to incidents so that organizational systems and networks can recover quickly and implement the necessary controls to avoid future incidents. Incident response team personnel include forensic and malicious code analysts, tool developers, systems security and privacy engineers, and real-time operations personnel. The incident handling capability includes performing rapid forensic preservation of evidence and analysis of and response to intrusions. For some organizations, the incident response team can be a cross-organizational entity.
An integrated incident response team facilitates information sharing and allows organizational personnel (e.g., developers, implementers, and operators) to leverage team knowledge of the threat and implement defensive measures that enable organizations to deter intrusions more effectively. Moreover, integrated teams promote the rapid detection of intrusions, the development of appropriate mitigations, and the deployment of effective defensive measures. For example, when an intrusion is detected, the integrated team can rapidly develop an appropriate response for operators to implement, correlate the new incident with information on past intrusions, and augment ongoing cyber intelligence development. Integrated incident response teams are better able to identify adversary tactics, techniques, and procedures that are linked to the operations tempo or specific mission and business functions and to define responsive actions in a way that does not disrupt those mission and business functions. Incident response teams can be distributed within organizations to make the capability resilient.
Assessment Objective
- an integrated incident response team is established and maintained;
- the integrated incident response team can be deployed to any location identified by the organization in [Assignement: time period].
Assessment Method
Examine
Incident response policy
procedures addressing incident handling
procedures addressing incident response planning
incident response plan
system security plan
privacy plan
other relevant documents or records
Interview
Organizational personnel with incident handling responsibilities
organizational personnel with information security and privacy responsibilities
members of the integrated incident response team
1. Przegląd
1.1 Odwołania
1.2 Zidentyfikowane wymagania
1.3 Powiązane regulacje
2. Zidentyfikowane wymagania
Wymagania
| Źródło |
Wymaganie |
3. Powiązane regulacje
Regulacje
| Źródło |
Regulacja |
Powiązane zgłoszenia
|