Framework Category

Incident Management

Incident Management involves executing a coordinated response once an incident is declared.

It includes validating and prioritizing reports, escalating as necessary, and applying predefined criteria to determine when to transition from response to recovery.

Implementation Questions

RS.MA-01

The incident response plan is executed in coordination with relevant third parties once an incident is declared

Do your detection technologies automatically report confirmed security incidents to appropriate personnel or systems?

Automated incident reporting ensures that security events are promptly escalated without manual intervention, reducing response time and minimizing potential damage. This capability is critical for maintaining continuous security monitoring and enabling rapid incident response, especially during off-hours or when security staff are unavailable.

Does your organization have a formal agreement with an external incident response provider that can be engaged when needed?

External response support is the concern: the question is whether you hold a formal agreement with an outside incident response provider you can engage when an incident exceeds internal capacity. Having a pre-established relationship with incident response specialists ensures rapid access to expertise during critical security events, potentially reducing the impact and recovery time of incidents.

Does your organization assign a designated incident lead for each security incident?

Designating a specific incident lead for each security incident ensures clear accountability, streamlined communication, and effective coordination of response activities. This role is responsible for making critical decisions, managing the incident response team, and serving as the central point of contact throughout the incident lifecycle.

Does your organization have a process to activate additional cybersecurity plans (such as business continuity and disaster recovery) during incident response when needed?

During a security incident, organizations may need to activate additional response mechanisms beyond the standard incident response procedures.

RS.MA-02

Incident reports are triaged and validated

Does your organization have a process to initially screen and validate incident reports to determine if they are cybersecurity-related and require incident response procedures?

Incident triage is what's assessed: whether you have a process to screen and validate incoming reports to confirm they are cybersecurity-related before invoking full response.

Does your organization have documented criteria for estimating the severity of security incidents?

Established severity criteria help organizations consistently evaluate and prioritize security incidents based on factors like impact to systems, data sensitivity, and business operations. Without clear criteria, incident response may be inconsistent, leading to improper resource allocation or delayed response to critical incidents.

RS.MA-03

Incidents are categorized and prioritized

Does your organization have a process to categorize security incidents by type (e.g., data breach, ransomware, DDoS, account compromise)?

Categorizing security incidents by type enables organizations to apply appropriate response procedures, allocate resources efficiently, and identify patterns or trends in security events. For example, a data breach requires different response actions than a DDoS attack, and categorization ensures the right teams and procedures are activated.

Does your organization have a documented incident prioritization framework that considers scope, impact, and time-sensitivity?

An incident prioritization framework helps security teams focus resources on the most critical incidents first, ensuring efficient response to security events. The framework should evaluate incidents based on their scope (how many systems/users are affected), potential impact (financial, operational, reputational damage), and time-sensitivity (how quickly the incident must be addressed to prevent escalation).

Does your organization have a documented process for selecting incident response strategies that balance rapid recovery with investigation needs during active incidents?

Incident response often forces a trade-off between speed and insight, and reviewers want a documented process for choosing strategies that balance rapid recovery against investigation needs. For example, immediately shutting down compromised systems may stop an attack but destroy valuable forensic evidence, while allowing limited continued access under monitoring might reveal the attacker's methods and targets.

RS.MA-04

Incidents are escalated or elevated as needed

Does your organization have a formal process to track and validate the status of all cybersecurity incidents from identification through resolution?

Tracking incidents to closure is the concern, namely whether you have a formal process to follow and validate the status of every cybersecurity incident from identification through resolution. Effective incident tracking ensures that security events don't fall through the cracks, appropriate resources are allocated, and management has visibility into ongoing security issues.

Does your organization have a documented incident escalation procedure that defines coordination with both internal stakeholders (e.g., management, legal) and external parties (e.g., customers, regulators, law enforcement)?

Escalation governance is the subject here, namely whether you have a documented procedure for coordinating incidents with internal stakeholders like management and legal as well as external parties such as customers, regulators, and law enforcement.

RS.MA-05

The criteria for initiating incident recovery are applied

Has your organization established and documented criteria for determining when incident recovery processes should be initiated based on incident characteristics?

Recovery activation criteria are what's being assessed: whether you have defined and documented the thresholds that determine when incident recovery processes kick in.

Has your organization assessed and documented how incident recovery activities might impact normal business operations?

Recovery impact on the business is what reviewers want analyzed: whether you have assessed and documented how incident recovery activities might disrupt normal operations. For example, restoring systems from backups might require temporary service outages, isolating infected systems could impact connected business processes, or redirecting staff to incident response might delay other critical functions.