RS.MA-01.310
Does your organization assign a designated incident lead for each security incident?
Explanation
Designating a specific incident lead for each security incident ensures clear accountability, streamlined communication, and effective coordination of response activities. This role is responsible for making critical decisions, managing the incident response team, and serving as the central point of contact throughout the incident lifecycle.
Evidence of this practice could include an incident response plan or playbook that clearly defines the incident lead role and selection process, documentation of past incidents showing assigned leads, or a roster of qualified staff who can serve as incident leads with their areas of expertise.
Implementation Example
Designate an incident lead for each incident
ID: RS.MA-01.310
Context
- Function
- RS: RESPOND
- Category
- RS.MA: Incident Management
- Sub-Category
- The incident response plan is executed in coordination with relevant third parties once an incident is declared
Related questions
- Do your detection technologies automatically report confirmed security incidents to appropriate personnel or systems?
- Does your organization have a formal agreement with an external incident response provider that can be engaged when needed?
- Does your organization have a process to activate additional cybersecurity plans (such as business continuity and disaster recovery) during incident response when needed?
- Does your organization have a process to initially screen and validate incident reports to determine if they are cybersecurity-related and require incident response procedures?
- Does your organization have documented criteria for estimating the severity of security incidents?
- Does your organization have a process to categorize security incidents by type (e.g., data breach, ransomware, DDoS, account compromise)?
