Does your organization have a process to identify and implement improvements to incident response procedures based on findings from exercises, tests, and reviews?
Explanation
Continuous improvement is the concern here: whether you have a process to fold findings from exercises, tests, and reviews back into stronger incident response procedures.
Effective incident response requires continuous improvement through analysis of performance in tabletop exercises, simulations, internal reviews, and independent audits.
Organizations should document identified gaps, create action plans to address them, and implement improvements to procedures, training, and tools.
Evidence could include a post-incident review document or improvement tracking system that shows: (1) findings from incident response assessments, (2) recommended improvements, (3) implementation status of those improvements, and (4) verification that changes were incorporated into updated incident response procedures.
Implementation Example
Identify improvements for future incident response activities based on findings from incident response assessments (e.g., tabletop exercises and simulations, tests, internal reviews, independent audits)
ID: ID.IM-02.180
Context
- Function
- ID: IDENTIFY
- Category
- ID.IM: Improvement
- Sub-Category
- Improvements are identified from security tests and exercises, including those done in coordination with suppliers and relevant third parties
Related questions
- Does your organization regularly conduct self-assessments of critical services that incorporate current threat intelligence and adversary tactics, techniques, and procedures (TTPs)?
- Has your organization conducted third-party assessments or independent audits of your cybersecurity program within the past 12 months?
- Does your organization utilize automated tools or systems to continuously evaluate compliance with your established cybersecurity requirements?
- Does your organization have a formal process to identify and implement improvements to business continuity, disaster recovery, and incident response plans based on exercises conducted with critical service providers and suppliers?
- Does your organization involve internal stakeholders (such as senior executives, legal, and HR) in security tests and exercises?
- Does your organization conduct penetration testing on high-risk systems with leadership approval?