RS.AN: Incident Analysis
Previous Version:
- NIST Cybersecurity Framework v1.1:
- RS.AN: Analysis
Description
Investigations are conducted to ensure effective response and support forensics and recovery activities
Framework Subcategories
RS.AN-03: Analysis is performed to establish what has taken place during an incident and the root cause of the incident
[csf.tools Note: Subcategories do not have detailed descriptions.]
RS.AN-06: Actions performed during an investigation are recorded, and the records’ integrity and provenance are preserved
[csf.tools Note: Subcategories do not have detailed descriptions.]
RS.AN-07: Incident data and metadata are collected, and their integrity and provenance are preserved
[csf.tools Note: Subcategories do not have detailed descriptions.]
RS.AN-08: An incident’s magnitude is estimated and validated
[csf.tools Note: Subcategories do not have detailed descriptions.]