Куда я попал?
CIS Critical Security Controls v8 (The 18 CIS CSC)
Framework
Incident Response
Для проведения оценки соответствия по документу войдите в систему.
Список требований
-
17.2 Establish and Maintain Contact Information for Reporting Security Incidents
Establish and maintain contact information for parties that need to be informed of security incidents. Contacts may include internal staff, third-party vendors, law enforcement, cyber insurance providers, relevant government agencies, Information Sharing and AnalyОбязательно для implementation Group 1 2 3 -
17.4 Establish and Maintain an Incident Response Process
Establish and maintain an incident response process that addresses roles and responsibilities, compliance requirements, and a communication plan. Review annually, or when significant enterprise changes occur that could impact this Safeguard.Обязательно для implementation Group 2 3 -
17.5 Assign Key Roles and Responsibilities
Assign key roles and responsibilities for incident response, including staff from legal, IT, information security, facilities, public relations, human resources, incident responders, and analysts, as applicable. Review annually, or when significant enterprise changes occur that could impact this Safeguard.Обязательно для implementation Group 2 3 -
17.7 Conduct Routine Incident Response Exercises
Plan and conduct routine incident response exercises and scenarios for key personnel involved in the incident response process to prepare for responding to real-world incidents. Exercises need to test communication channels, decision-making, and workflows. Conduct testing on an annual basis, at a minimum.Обязательно для implementation Group 2 3
Мы используем cookie-файлы, чтобы получить статистику, которая помогает нам улучшить сервис для вас с целью персонализации сервисов и предложений. Вы может прочитать подробнее о cookie-файлах или изменить настройки браузера. Продолжая пользоваться сайтом, вы даёте согласие на использование ваших cookie-файлов и соглашаетесь с Политикой обработки персональных данных.