RS.MA Incident Management

Statement

The incident response plan is executed in coordination with relevant third parties once an incident is declared

Guidance

Detection technologies automatically report confirmed incidents

Guidance

Request incident response assistance from the organization's incident response outsourcer

Guidance

Designate an incident lead for each incident

Guidance

Initiate execution of additional cybersecurity plans as needed to support incident response (for example, business continuity and disaster recovery)

Statement

Incident reports are triaged and validated

Guidance

Preliminarily review incident reports to confirm that they are cybersecurity-related and necessitate incident response activities

Guidance

Apply criteria to estimate the severity of an incident

Statement

Incidents are categorized and prioritized

Guidance

Further review and categorize incidents based on the type of incident (e.g., data breach, ransomware, DDoS, account compromise)

Guidance

Prioritize incidents based on their scope, likely impact, and time-critical nature

Guidance

Select incident response strategies for active incidents by balancing the need to quickly recover from an incident with the need to observe the attacker or conduct a more thorough investigation

Statement

Incidents are escalated or elevated as needed

Guidance

Track and validate the status of all ongoing incidents

Guidance

Coordinate incident escalation or elevation with designated internal and external stakeholders

Statement

The criteria for initiating incident recovery are applied

Guidance

Apply incident recovery criteria to known and assumed characteristics of the incident to determine whether incident recovery processes should be initiated

Guidance

Take the possible operational disruption of incident recovery activities into account