Navigate

CCI-004136

CCI-004136 Definition

Ensure the results of incident handling activities are comparable and predictable across the organization.

Status
Type	CheckType.policy

Master Assessment Datasheet

Implementation Guidance

Determine if: - the rigor of incident handling activities is comparable and predictable across the organization. - the intensity of incident handling activities is comparable and predictable across the organization. - the scope of incident handling activities is comparable and predictable across the organization. - the results of incident handling activities are comparable and predictable across the organization.

Validation Procedures

Examine: [SELECT FROM: Incident response policy; contingency planning policy; procedures addressing incident handling; incident response plan; contingency plan; system security plan; privacy plan; other relevant documents or records]. Interview: [SELECT FROM: Organizational personnel with incident handling responsibilities; organizational personnel with contingency planning responsibilities; organizational personnel with information security and privacy responsibilities]. Test: [SELECT FROM: Incident handling capability for the organization].

Related Controls

The controls below (if any) were marked by NIST as being related to CCI-004136.

Control	Description
IR-4	a: Implement an incident handling capability for incidents that is consistent with the incident response plan and includes preparation, detection and analysis, containment, eradication, and recovery; b: Coordinate incident handling activities with contingency planning activities; c: Incorporate lessons learned from ongoing incident handling activities into incident response procedures, training, and testing, and implement the resulting changes accordingly; and d: Ensure the rigor, intensity, scope, and results of incident handling activities are comparable and predictable across the organization.

Control

Description

IR-4

a: Implement an incident handling capability for incidents that is consistent with the incident response plan and includes preparation, detection and analysis, containment, eradication, and recovery;

b: Coordinate incident handling activities with contingency planning activities;

c: Incorporate lessons learned from ongoing incident handling activities into incident response procedures, training, and testing, and implement the resulting changes accordingly; and

d: Ensure the rigor, intensity, scope, and results of incident handling activities are comparable and predictable across the organization.