RS.MA: Incident Management
Category is new to this version of the framework and incorporates the following item from the previous version: RS.RP: Response Planning.
Description
Responses to detected cybersecurity incidents are managed
Framework Subcategories
RS.MA-01: The incident response plan is executed in coordination with relevant third parties once an incident is declared
[csf.tools Note: Subcategories do not have detailed descriptions.]
RS.MA-02: Incident reports are triaged and validated
[csf.tools Note: Subcategories do not have detailed descriptions.]
RS.MA-03: Incidents are categorized and prioritized
[csf.tools Note: Subcategories do not have detailed descriptions.]
RS.MA-04: Incidents are escalated or elevated as needed
[csf.tools Note: Subcategories do not have detailed descriptions.]
RS.MA-05: The criteria for initiating incident recovery are applied
[csf.tools Note: Subcategories do not have detailed descriptions.]