Navigate

CCI-001625

CCI-001625 Definition

The organization implements the resulting incident handling activity changes to incident response procedures, training, and testing/exercises accordingly.

Status
Type	CheckType.policy

Master Assessment Datasheet

Implementation Guidance

The organization being inspected/assessed will follow the latest incident response plan (IR-8) that has been revised (based on IR-4, CCI-000824) and disseminated.

Validation Procedures

The organization conducting the inspection/assessment obtains and examines recent changes to the incident response plan (based on IR-4, CCI 000824) to verify that they have been disseminated and reviews the most recent after action report to ensure that changes have been followed.

Compelling Evidence

1.) Signed and dated Incident Response Plan 2.) After action reports

Related Controls

The controls below (if any) were marked by NIST as being related to CCI-001625.

Control	Description
IR-4	The organization: IR-4a.: Implements an incident handling capability for security incidents that includes preparation, detection and analysis, containment, eradication, and recovery; IR-4b.: Coordinates incident handling activities with contingency planning activities; and IR-4c.: Incorporates lessons learned from ongoing incident handling activities into incident response procedures, training, and testing, and implements the resulting changes accordingly.

Control

Description

IR-4

The organization:

IR-4a.: Implements an incident handling capability for security incidents that includes preparation, detection and analysis, containment, eradication, and recovery;

IR-4b.: Coordinates incident handling activities with contingency planning activities; and

IR-4c.: Incorporates lessons learned from ongoing incident handling activities into incident response procedures, training, and testing, and implements the resulting changes accordingly.