RS.MA-01.309
Does your organization have a formal agreement with an external incident response provider that can be engaged when needed?
Explanation
This question assesses whether your organization has established a relationship with an external incident response service provider that can be called upon during security incidents that exceed internal capabilities. Having a pre-established relationship with incident response specialists ensures rapid access to expertise during critical security events, potentially reducing the impact and recovery time of incidents. Evidence could include a signed service level agreement (SLA) or contract with an incident response provider, documentation showing the process for requesting external assistance, and contact information for the provider's incident response team.
Implementation Example
Request incident response assistance from the organization's incident response outsourcer
ID: RS.MA-01.309
Context
- Function
- RS: RESPOND
- Category
- RS.MA: Incident Management
- Sub-Category
- The incident response plan is executed in coordination with relevant third parties once an incident is declared
