Framework Category

Incident Analysis

Incident Analysis focuses on investigating and understanding cybersecurity incidents by identifying root causes, estimating impact, and categorizing events according to response plans.

It ensures proper handling of disclosed vulnerabilities, maintains detailed records with integrity, and supports informed response through structured analysis.

Implementation Questions

RS.AN-01

Notifications from detection systems are investigated

NIST CSF Incident Analysis (RS.AN-01) — Notifications from detection systems are investigated: implementation questions and what each one covers
Question	What it covers
Does your organization have a documented process for investigating notifications from security detection systems?	Investigating detection alerts is the subject, specifically whether you have a documented process for following up on notifications from systems such as IDS, SIEM, or EDR. Proper investigation of these notifications is crucial for identifying potential security incidents, determining their scope and impact, and initiating appropriate response actions.

RS.AN-02

The impact of the incident is understood

NIST CSF Incident Analysis (RS.AN-02) — The impact of the incident is understood: implementation questions and what each one covers
Question	What it covers
Does your organization have a formal process to assess and document the impact of security incidents?	Understanding the impact of security incidents is crucial for effective incident response and recovery. This involves evaluating the technical, operational, financial, and reputational consequences of an incident to prioritize response actions and allocate appropriate resources. Impact analysis should consider affected systems, data compromise, service disruptions, and potential regulatory implications.

RS.AN-03

Analysis is performed to establish what has taken place during an incident and the root cause of the incident

NIST CSF Incident Analysis (RS.AN-03) — Analysis is performed to establish what has taken place during an incident and the root cause of the incident: implementation questions and what each one covers
Question	What it covers
Does your organization have a documented process for reconstructing the chronological sequence of security incidents, including all affected assets and resources?	Reconstructing what happened and when is the concern here, specifically whether you have a documented process to rebuild the chronological sequence of an incident across all affected assets. Proper incident timeline reconstruction helps identify which systems were compromised first, how the attack propagated through your environment, and what data or resources may have been accessed or modified during each phase of the incident.
Does your incident response process include identification and analysis of vulnerabilities, threats, and threat actors involved in security incidents?	Root-cause analysis during incident response is the focus, namely whether your process identifies and analyzes the vulnerabilities, threats, and threat actors involved in security incidents. A comprehensive incident analysis helps prevent similar incidents in the future by addressing specific weaknesses and understanding attack patterns and motivations.
Does your organization conduct root cause analysis to identify systemic issues when investigating security incidents?	Root cause analysis goes beyond addressing the immediate symptoms of a security incident to identify the fundamental, systemic issues that allowed the incident to occur.
Does your organization utilize cyber deception technologies to gather intelligence on attacker behavior and tactics?	Cyber deception technologies (such as honeypots, honeyfiles, or decoy systems) can provide valuable insights into attacker methodologies, tools, and objectives by monitoring how adversaries interact with fake assets. These technologies act as early warning systems and can reveal attacker patterns that might otherwise go undetected in your actual production environment.

RS.AN-04

Incidents are categorized consistent with response plans

NIST CSF Incident Analysis (RS.AN-04) — Incidents are categorized consistent with response plans: implementation questions and what each one covers
Question	What it covers
Does your organization categorize security incidents according to established incident response plans?	Incident classification is the focus here, asking whether you categorize security incidents according to the categories defined in your incident response plans. Proper categorization ensures appropriate response procedures are followed based on incident type, severity, and impact (e.g., data breach, malware infection, denial of service).

RS.AN-05

Processes are established to receive, analyze and respond to vulnerabilities disclosed to the organization from internal and external sources (e.g. internal testing, security bulletins, or security researchers)

NIST CSF Incident Analysis (RS.AN-05) — Processes are established to receive, analyze and respond to vulnerabilities disclosed to the organization from internal and external sources (e.g. internal testing, security bulletins, or security researchers): implementation questions and what each one covers
Question	What it covers
Does your organization have a formal process to receive, analyze, and respond to security vulnerabilities disclosed from both internal and external sources?	Vulnerability handling is the focus here, specifically whether a formal process lets you receive, analyze, and respond to flaws disclosed from both internal and external sources. An effective vulnerability management process ensures timely identification, prioritization, and remediation of security weaknesses before they can be exploited.

RS.AN-06

Actions performed during an investigation are recorded, and the records' integrity and provenance are preserved

NIST CSF Incident Analysis (RS.AN-06) — Actions performed during an investigation are recorded, and the records' integrity and provenance are preserved: implementation questions and what each one covers
Question	What it covers
Does your organization require incident responders and other relevant personnel to maintain immutable records of all actions taken during incident response activities?	Maintaining immutable records of incident response actions creates an audit trail that cannot be altered after the fact, ensuring accountability and providing crucial forensic evidence. These records should capture all actions taken by incident responders, system administrators, and cybersecurity engineers during an incident, including system changes, communication logs, and investigative steps.
Does your organization require incident leads to document security incidents in detail and maintain the integrity of all incident documentation and information sources?	Defensible incident records are the focus here, covering whether incident leads are required to document events in detail and preserve the integrity of all documentation and sources.

RS.AN-07

Incident data and metadata are collected, and their integrity and provenance are preserved

NIST CSF Incident Analysis (RS.AN-07) — Incident data and metadata are collected, and their integrity and provenance are preserved: implementation questions and what each one covers
Question	What it covers
Does your organization have documented procedures for collecting, preserving, and safeguarding incident data and metadata while maintaining chain-of-custody?	Sound evidence handling is the focus here: whether you have documented procedures for collecting, preserving, and protecting incident data and metadata while maintaining chain-of-custody. Proper evidence handling includes documenting when and how data was collected, securing it against tampering, and maintaining detailed records of who accessed it and when.

RS.AN-08

An incident's magnitude is estimated and validated

NIST CSF Incident Analysis (RS.AN-08) — An incident's magnitude is estimated and validated: implementation questions and what each one covers
Question	What it covers
When responding to a security incident, does your organization have a process to identify and examine other potential targets for indicators of compromise and evidence of attacker persistence?	During a security incident, attackers often compromise multiple systems or accounts to maintain access even if the initial entry point is discovered.
Does your organization employ automated tools to detect indicators of compromise and evidence of persistence across your systems?	Automated tools like endpoint detection and response (EDR), security information and event management (SIEM) systems, or threat hunting platforms should continuously monitor your environment for signs of malicious activity. These tools can identify unusual behaviors, known malware signatures, unauthorized access attempts, and persistent threats that may have established a foothold in your systems.