Navigate

CCI-000822

CCI-000822 Definition

Implement an incident handling capability for incidents that is consistent with the incident response plan and includes preparation, detection and analysis, containment, eradication, and recovery.

Status
Type	CheckType.policy

Master Assessment Datasheet

Implementation Guidance

Determine if: - an incident handling capability for incidents is implemented that is consistent with the incident response plan. - the incident handling capability for incidents includes preparation. - the incident handling capability for incidents includes detection and analysis. - the incident handling capability for incidents includes containment. - the incident handling capability for incidents includes eradication. - the incident handling capability for incidents includes recovery.

Validation Procedures

Examine: [SELECT FROM: Incident response policy; contingency planning policy; procedures addressing incident handling; incident response plan; contingency plan; system security plan; privacy plan; other relevant documents or records]. Interview: [SELECT FROM: Organizational personnel with incident handling responsibilities; organizational personnel with contingency planning responsibilities; organizational personnel with information security and privacy responsibilities]. Test: [SELECT FROM: Incident handling capability for the organization].

Related Controls

The controls below (if any) were marked by NIST as being related to CCI-000822.

Control	Description
IR-4	a: Implement an incident handling capability for incidents that is consistent with the incident response plan and includes preparation, detection and analysis, containment, eradication, and recovery; b: Coordinate incident handling activities with contingency planning activities; c: Incorporate lessons learned from ongoing incident handling activities into incident response procedures, training, and testing, and implement the resulting changes accordingly; and d: Ensure the rigor, intensity, scope, and results of incident handling activities are comparable and predictable across the organization.

Control

Description

IR-4

a: Implement an incident handling capability for incidents that is consistent with the incident response plan and includes preparation, detection and analysis, containment, eradication, and recovery;

b: Coordinate incident handling activities with contingency planning activities;

c: Incorporate lessons learned from ongoing incident handling activities into incident response procedures, training, and testing, and implement the resulting changes accordingly; and

d: Ensure the rigor, intensity, scope, and results of incident handling activities are comparable and predictable across the organization.