Objective: Once security events are reported, it is vital that the handling of the events is managed. This means to ensure that the type and criticality of the reported event as well as the persons responsible are quickly identified to ensure that time-critical aspects can be handled in time. Once identification is done, ensuring that the responsible persons become aware and deal with the event within a reasonable time frame is necessary. Furthermore, if the event affects multiple different persons, or management also include coordinating communication is a important part of event management. Finally, if there are external (contractual or regulatory) reporting requirements, its important to ensure that these are also fulfilled in a professional way.
Requirements (must): Reported events are processed without undue delay.
An adequate reaction to reported security events is ensured.
Lessons learned are incorporated into continuous improvement.
Requirements (should): During processing, reported events are categorized (e.g. by responsibility into personnel, physical and cyber), qualified (e.g. not security relevant, observation, suggested security improvement, security vulnerability, security incident) and prioritized (e.g. low, moderate, severe, critical).
Responsibilities for handling of events based on their category are defined and assigned. The following aspects are considered:
- Coordination of incidents and vulnerabilities across multiple categories
- Qualification and resources
- Contact mechanisms based on type and priority (e.g., non-time-critical communication, time-critical communication, emergency communication)
- Absence-management
A strategy for filing official reports and searching prosecution of potentially criminally relevant aspects of security incidents exists. (C, I, A)
All security incidents are addressed in a consistent manner to improve security based on what has happened.
In the incident treatment process:
The organization shall ensure that clear persons are assigned to incident management responsibilities, e.g. handling the first response for incidents.
Incident management personnel need to be instructed and trained to understand the organization's priorities in dealing with security incidents.
The organization has defined a process and the team involved in responding promptly to security incidents and deciding on the appropriate actions.
The first level response process includes at least:
Our organization has pre-defined procedures through which the detected security breach will be addressed. The process may include e.g. the following things:
Organisation should have a procedure for categorizing security incidents during processing. The incident should be categorized to at least the following categories:
The incident should then be qualified based on it's effects for example into:
The incidents should then be prioritized based on the severity of the incident.
If it is difficult to identify the source of a security incident based on the primary treatment, a separate follow-up analysis is performed for the incident, in which the root cause is sought to be identified.
The knowledge gained from analyzing and resolving security incidents should be used to reduce the likelihood of future incidents and their impact.
The organization regularly analyzes incidents as a whole. This process examines the type, amount and cost of incidents with the aim of identifying recurrent and significant incidents that need more action.
If recurrent incidents requiring response are identified, based on them:
The organization has defined procedures to ensure that the original reporter and other personnel involved in the incident are informed of the outcome of the incident management.
Linked personnel can be documented on an optional field on the incident documentation template.
In Cyberday, all frameworks’ requirements are mapped into universal tasks, so you achieve multi-framework compliance effortlessly.
.png)
Elevate Your Knowledge with Exclusive Access to Weekly Webinars, Video Courses, Help Articles, and Blogs.
