3.5 Incident response

Requirement

The relevant entities shall respond to incidents in accordance with documented procedures and in a timely manner.

Guidance

• Establish a dedicated incident response team comprising employees with the necessary technical expertise and authority to respond effectively to incidents, where appropriate.
• Define roles and responsibilities within the incident response team, such as incident coordinators, analysts and communication liaisons, where appropriate.
• Take into account industry-recognised standards when developing the incident response procedures (33).
• Implement playbooks or runbooks to guide incident response actions for common types of incidents.

Examples of evidence

• Assignment of roles within the incident response team.
• Documented standards and/or good practices that are taken into account.
• Playbooks or incident response plans for common types of incidents.

Requirement

The incident response procedures shall include the following stages: (a) incident containment, to prevent the consequences of the incident from spreading; (b) eradication, to prevent the incident from continuing or reappearing, (c) recovery from the incident, where necessary.

Guidance

• Create incident response procedures outlining the steps referred to in point 3.5.2 of the Annex to the regulation.
• Ensure that the handling of cybersecurity incidents takes into account the entity’s priorities and the impact of the incident.
  • Recognize and address potential conflicts between the following objectives during incident handling:
    • forensic activities – preserving and securing evidence for legal, compliance or investigative purposes,
    • incident response activities – mitigating and removing current threats to prevent further damage and
    • operational continuity – minimizing disruption to IT services and maintaining critical operations.
  • Where these objectives conflict, establish a clear decision-making process that:
    • prioritises based on the accepted risk tolerance levels, business impact and legal obligations,
    • involves coordination between cybersecurity, legal/compliance and operational teams and
    • documents the rationale for prioritisation decisions to ensure transparency and accountability.
  • Develop incident response playbooks that incorporate decision making and escalation paths for managing trade-offs between evidence preservation, threat containment and operational continuity.
• Keep the management bodies informed.

Examples of evidence

• Procedures for incident response, including types of incidents that could occur, objectives, roles and responsibilities. Detailed description, for each incident type, of how to manage the incident and when to escalate to management bodies (e.g. chief information security officer), etc.
• Records from resolution of conflicting objectives during response to past incidents.

Requirement

The relevant entities shall establish communication plans and procedures: (a) with the Computer Security Incident Response Teams (CSIRTs) or, where applicable, the competent authorities, related to incident notification; (b) with relevant internal and external stakeholders.

Guidance

• Ensure that the communication plan (Annex to the regulation, point 3.1.2) includes procedures for how to communicate the incident to the relevant authorities, the national CSIRT and internal and external stakeholders, including, where applicable, customers, direct suppliers, service providers and, if open source is used, contacts for free and open source software projects.
• Include contact information for key personnel, external stakeholders and relevant authorities.

Examples of evidence

• Procedures for how to communicate the incident to the relevant authorities and the CSIRT.
• Procedures for how to communicate the incident to customers or how and when to involve a supplier (if applicable).

Requirement

The relevant entities shall log incident response activities in accordance with the procedures referred to in point

Requirement

The relevant entities shall test at planned intervals their incident response procedures.

Guidance

• Test the entity’s incident response procedures at least annually.
• Test different types of incidents, for example ransomware, phishing, data breach and DoS.
• Ensure that test scenarios involve employees from different departments as well as external stakeholders, for example suppliers and service providers.
  • Where necessary, include management bodies in the tests so that they understand their role during an incident.
• Conduct post-test reviews for possible lessons learnt.
• Update the incident response procedures based on the lessons learnt from the test, if applicable.

Examples of evidence

• Documented plans or schedules for future incident response tests.
• Records from tests of different types of incidents.

Tips: guidance

• Issue instructions on how to respond to the most common types of incidents (ransomware, phishing, data breach, DoS, etc.) including containment, eradication and recovery steps.
• Include guidelines for preserving evidence and maintaining chain of custody to support forensic analysis and legal proceedings if necessary.
• Consider the use of automated solutions for incident response, for example security orchestration, automation and response technologies or similar systems.

Tips: examples of evidence

• Up-to-date incident response procedures based on tests conducted and/or change logs.