RS.MA-03: Incidents are categorized and prioritized

Subcategory is new to this version of the framework and incorporates the following items from the previous version: RS.AN-2: The impact of the incident is understood, RS.AN-4: Incidents are categorized consistent with response plans.

Description

[csf.tools Note: Subcategories do not have detailed descriptions. However NIST has provided the following implementation examples.]

Implementation Examples

1st: 1st Party Risk

Ex1: Further review and categorize incidents based on the type of incident (e.g., data breach, ransomware, DDoS, account compromise)

Ex2: Prioritize incidents based on their scope, likely impact, and time-critical nature

Ex3: Select incident response strategies for active incidents by balancing the need to quickly recover from an incident with the need to observe the attacker or conduct a more thorough investigation

NIST Special Publication 800-53 Revision 5.2.0

IR-4: Incident Handling

Implement an incident handling capability for incidents that is consistent with the incident response plan and includes preparation, detection and analysis, containment, eradication, and recovery; Coordinate incident handling activities with contingency planning activities; Incorporate lessons learned from ongoing incident handling activities into incident response procedures, training, and testing, and implement the resulting changes accordingly; and…

IR-5: Incident Monitoring

Track and document incidents.

IR-6: Incident Reporting

Require personnel to report suspected incidents to the organizational incident response capability within [Assignment: organization-defined time period] ; and Report incident information to [Assignment: organization-defined authorities].

IR-7: Incident Response Assistance

Provide an incident response support resource, integral to the organizational incident response capability, that offers advice and assistance to users of the system for the handling and reporting of incidents.

IR-8: Incident Response Plan

Develop an incident response plan that: Provides the organization with a roadmap for implementing its incident response capability; Describes the structure and organization of the incident response capability; Provides a high-level approach for how the incident response capability fits into the overall organization; Meets the unique requirements of the organization, which relate to mission, size,…

IR-9: Information Spillage Response

Respond to information spills by: Assigning [Assignment: organization-defined personnel or roles] with responsibility for responding to information spills; Identifying the specific information involved in the system contamination; Alerting [Assignment: organization-defined personnel or roles] of the information spill using a method of communication not associated with the spill; Isolating the contaminated system or system component; Eradicating…

NIST SP 800-171 Revision 3.0

03.06.01: Incident Handling

Implement an incident-handling capability that is consistent with the incident response plan and includes preparation, detection and analysis, containment, eradication, and recovery.

03.06.02: Incident Monitoring, Reporting, and Response Assistance

Track and document system security incidents. Report suspected incidents to the organizational incident response capability within [Assignment: organization-defined time period]. Report incident information to [Assignment: organization-defined authorities]. Provide an incident response support resource that offers advice and assistance to system users on handling and reporting incidents.

03.06.05: Incident Response Plan

Develop an incident response plan that: Provides the organization with a roadmap for implementing its incident response capability, Describes the structure and organization of the incident response capability, Provides a high-level approach for how the incident response capability fits into the overall organization, Defines reportable incidents, Addresses the sharing of incident information, and Designates responsibilities…

Cloud Controls Matrix v4.0

SEF-02: Service Management Policy and Procedures

Establish, document, approve, communicate, apply, evaluate and maintain policies and procedures for the timely management of security incidents. Review and update the policies and procedures at least annually.

SEF-06: Event Triage Processes

Define, implement and evaluate processes, procedures and technical measures supporting business processes to triage security-related events.