Does your organization have formal agreements with third parties (e.g., ISPs, MSSPs) authorizing them to perform containment actions during security incidents?
Explanation
Third-party containment authority is under review, namely whether formal agreements let parties like ISPs or MSSPs take containment actions during your security incidents. Such arrangements can be crucial during critical incidents when internal resources may be overwhelmed or when specialized expertise is required for effective containment.
Evidence could include signed service level agreements (SLAs) with third parties that explicitly authorize containment actions, documented procedures for third-party incident response, or records of tabletop exercises conducted with these third parties to test containment procedures.
Implementation Example
Allow a third party (e.g., internet service provider, managed security service provider) to perform containment actions on behalf of the organization
ID: RS.MI-01.341
Context
- Function
- RS: RESPOND
- Category
- RS.MI: Incident Mitigation
- Sub-Category
- Incidents are contained
Related questions
- Do your cybersecurity technologies and security features in other systems automatically perform containment actions when threats are detected?
- Does your incident response process allow responders to manually select and execute containment actions during security incidents?
- Does your organization automatically transfer compromised endpoints to a remediation VLAN for isolation and remediation?
- Does your organization implement automated eradication capabilities within cybersecurity technologies and security features of other technologies?
- Does your incident response system allow authorized responders to manually select and execute eradication actions during security incidents?
- Does your organization have formal agreements in place with third-party security providers to perform incident eradication actions on your behalf?