RS.AN-02
Does your organization have a formal process to assess and document the impact of security incidents?
Explanation
Understanding the impact of security incidents is crucial for effective incident response and recovery. This involves evaluating the technical, operational, financial, and reputational consequences of an incident to prioritize response actions and allocate appropriate resources. Impact analysis should consider affected systems, data compromise, service disruptions, and potential regulatory implications.
Evidence could include incident impact assessment templates, completed incident reports with impact sections, post-incident analysis documentation, or a formal incident classification matrix that categorizes incidents based on their impact severity.
Context
- Function
- RS: RESPOND
- Category
- RS.AN: Incident Analysis
- Sub-Category
- The impact of the incident is understood
Related questions
- Does your organization have a documented process for investigating notifications from security detection systems?
- Does your organization have a documented process for reconstructing the chronological sequence of security incidents, including all affected assets and resources?
- Does your incident response process include identification and analysis of vulnerabilities, threats, and threat actors involved in security incidents?
- Does your organization conduct root cause analysis to identify systemic issues when investigating security incidents?
- Does your organization utilize cyber deception technologies to gather intelligence on attacker behavior and tactics?
- Does your organization categorize security incidents according to established incident response plans?
