Incident Response (IR)
Provide an incident response training environment using [Assignment: organization-defined automated mechanisms].
Incident Response (IR)
Level N/A
Provide incident response training on how to identify and respond to a breach, including the organization’s process for reporting a breach.
Incident Response (IR)
Level N/A
Test the effectiveness of the incident response capability for the system [Assignment: organization-defined frequency] using the following tests: [Assignment: organization-defined tests].
Incident Response (IR)
Test the incident response capability using [Assignment: organization-defined automated mechanisms].
Incident Response (IR)
Coordinate incident response testing with organizational elements responsible for related plans.
Incident Response (IR)
Use qualitative and quantitative data from testing to: (a) Determine the effectiveness of incident response processes; (b) Continuously improve incident response processes; and (c) Provide incident response measures and metrics that are accurate, consistent, and in a reproducible format.
Incident Response (IR)
Level N/A
a. Implement an incident handling capability for incidents that is consistent with the incident response plan and includes preparation, detection and analysis, containment, eradication, and recovery; b. Coordinate incident handling activities with contingency planning activities; c. Incorporate lessons learned from ongoing incident handling activities into incident response procedures, training, and testing, and implement the resulting changes accordingly; and d. Ensure the rigor, intensity, scope, and results of incident handling activities are comparable and predictable across the organization.
Incident Response (IR)
Support the incident handling process using [Assignment: organization-defined automated mechanisms].
Incident Response (IR)
Include the following types of dynamic reconfiguration for [Assignment: organization-defined system components] as part of the incident response capability: [Assignment: organization-defined types of dynamic reconfiguration].
Incident Response (IR)
Identify [Assignment: organization-defined classes of incidents] and take the following actions in response to those incidents to ensure continuation of organizational mission and business functions: [Assignment: organization-defined actions to take in response to classes of incidents].
