Incident response plan execution

The organization shall ensure that clear persons are assigned to incident management responsibilities, e.g. handling the first response for incidents.

Incident management personnel need to be instructed and trained to understand the organization's priorities in dealing with security incidents.

The organization should create and maintain incident response plans. The response plans should include at least:

• Incident or the type of incident for which the plan has been made
• Goal for plan
• Responsible persons and related stakeholders and contact information
• Planned immediate actions
• Planned next steps

The organization shall establish a incident response plan for security incidents to critical information systems. Response plans should also be tested by the necessary organizational elements. The plan should take into account at least:

• The purpose of the information system and the precautions to be taken in the event of its disruption
• Recovery plans, targets, and priorities for the order of recovery of assets
• The role of implementing the response plans and the contact details of the persons assigned to the roles
•  Continuation of normal operations regardless of the state of the information systems.
• Distribution, approval and review of response plans

In addition, the plan should at least:

• Establish a roadmap for developing disruption management capacity
• Describe the structure and organization of incident management capability
• Provides metrics to measure incident management capability

In the event of an incident, the implementation of the response plan with stakeholders must be carried out as specified in the plan.