Navigate

CCI-000823

CCI-000823 Definition

Coordinate incident handling activities with contingency planning activities.

Status
Type	CheckType.policy

Master Assessment Datasheet

Implementation Guidance

Determine if incident handling activities are coordinated with contingency planning activities.

Validation Procedures

Examine: [SELECT FROM: Incident response policy; contingency planning policy; procedures addressing incident handling; incident response plan; contingency plan; system security plan; privacy plan; other relevant documents or records]. Interview: [SELECT FROM: Organizational personnel with incident handling responsibilities; organizational personnel with contingency planning responsibilities; organizational personnel with information security and privacy responsibilities]. Test: [SELECT FROM: Incident handling capability for the organization].

Related Controls

The controls below (if any) were marked by NIST as being related to CCI-000823.

Control	Description
IR-4	a: Implement an incident handling capability for incidents that is consistent with the incident response plan and includes preparation, detection and analysis, containment, eradication, and recovery; b: Coordinate incident handling activities with contingency planning activities; c: Incorporate lessons learned from ongoing incident handling activities into incident response procedures, training, and testing, and implement the resulting changes accordingly; and d: Ensure the rigor, intensity, scope, and results of incident handling activities are comparable and predictable across the organization.

Control

Description

IR-4

a: Implement an incident handling capability for incidents that is consistent with the incident response plan and includes preparation, detection and analysis, containment, eradication, and recovery;

b: Coordinate incident handling activities with contingency planning activities;

c: Incorporate lessons learned from ongoing incident handling activities into incident response procedures, training, and testing, and implement the resulting changes accordingly; and

d: Ensure the rigor, intensity, scope, and results of incident handling activities are comparable and predictable across the organization.