Area II (Security, Confidentiality & Privacy): Building and Running an Effective Incident Response Capability

Incident Response (IR)

An organized set of people, processes, and tools used to detect, analyze, contain, eradicate, and recover from security incidents.

Incident

An event that jeopardizes the confidentiality, integrity, or availability of systems or data.

NIST SP 800-61

A guide that outlines the incident response lifecycle including preparation, detection and analysis, containment, eradication, recovery, and post-incident activity.

Preparation

The phase of the incident response lifecycle that involves policies, roles, tools, and training.

Detection and Analysis

The phase where incidents are identified, validated, scoped, and prioritized.

Containment, Eradication, Recovery

The phase focused on stopping the spread of an incident, removing the cause, and safely restoring operations.

Post-incident Activity

Actions taken after an incident to learn and improve future responses.

Security Event

An observable occurrence that may indicate a security incident.

Security Incident

A confirmed or likely compromise of security policy that poses a material risk.

RACI

A responsibility assignment matrix that clarifies roles (Responsible, Accountable, Consulted, Informed) in an incident response.

Incident Categories

Classifications of incidents such as malware, unauthorized access, or data leakage.

Severity Levels

A measure based on data sensitivity, business impact, and likelihood of regulatory notification.

Escalation Triggers

Criteria that warrant elevating the response based on incident characteristics.

Documentation

The process of recording actions and decisions taken during an incident response for later reference.

Incident Response Plan (IRP)

A comprehensive document detailing how an organization should respond to incidents.

Playbook

A specific set of instructions for responding to particular types of incidents.

Visibility

The ability to monitor systems and gather necessary logs and information for effective incident response.

Privileged Access Management (PAM)

Controls to manage and secure access for users with elevated permissions.

Tabletop Exercises

Simulated scenarios conducted to practice incident response processes.

Containment Strategies

Immediate and long-term actions taken to stop an incident from spreading.

Eradication

The process of removing the attacker’s foothold to prevent reinfection.

Recovery

Restoring systems to normal operational status after an incident.

Communications Strategy

Plans for managing internal and external communications during and after an incident.

Chain of Custody

Documented evidence of who collected, accessed, and transferred evidence during an investigation.

Lessons Learned

Post-incident reviews that focus on understanding what happened and how to improve.

Corrective Action Plans

Actionable steps derived from lessons learned to prevent recurrence of incidents.

Metrics and Reporting

Data used to assess and improve incident response performance.

Control Testing Perspective

Assessment of incident response capability through documented processes and exercises.