Incident response plans (Incident Response and Business Continuity) and recovery plans (Incident Recovery and Disaster Recovery) shall be established, maintained, approved, and tested to determine the effectiveness of the plans, and the readiness to execute the plans.
Guidance
- The incident response plan is the documentation of a predetermined set of instructions or
procedures to detect, respond to, and limit consequences of a malicious cyber-attack.
- Plans should incorporate recovery objectives, restoration priorities, metrics, contingency roles,
personnel assignments and contact information.
- Maintaining essential functions despite system disruption, and the eventual restoration of the
organization’s systems, should be addressed.
- Consider defining incident types, resources and management support needed to effectively maintain
and mature the incident response and contingency capabilities.
The organization shall coordinate the development and the testing of incident response
plans and recovery plans with stakeholders responsible for related plans.
Guidance
Related plans include, for example, Business Continuity Plans, Disaster Recovery Plans, Continuity of
Operations Plans, Crisis Communications Plans, Critical Infrastructure Plans, Cyber incident response
plans, and Occupant Emergency Plans.
Sometimes an unexpected event, such as a fire, flood, or equipment failure, can cause downtime. In order to be able to continue operations as quickly and smoothly as possible, continuity planning is carried out, i.e. planning the operations in advance for these exceptional situations.
Each continuity plan shall contain at least the following information:
The organization must document in advance procedures for responding to security breaches to ensure the actions of related departments, customers, and other critical partners in the event of a security breach.
The organization has to include disaster recovery in their continuity planning. Relevant disasters for the planning are natural disasters (e.g floods, earthquake, hurricanes) and human caused disasters (e.g terror attack, chemical attack/incident, insider attack).
In disaster planning there is greater emphasis on the returning operations to normal levels safely than in continuity planning. After this focus moves to resuming normal operations.
The continuity plans must be updated at least annually or after significant changes.
The organisation should regularly, at least annually, test and review its information security continuity plans to ensure that they are valid and effective in adverse situations.
Testing of continuity plans shall involve, as appropriate, stakeholders critical to each plan. The organisation should identify and document the necessary contacts with suppliers and partners
In addition, the adequacy of continuity plans and associated management mechanisms should be reassessed in the event of significant changes in operations.
Elevate Your Knowledge with Exclusive Access to Weekly Webinars, Video Courses, Help Articles, and Blogs.
