Does your organization have formal agreements in place with third-party security providers to perform incident eradication actions on your behalf?
Explanation
Third-party security providers (such as Managed Security Service Providers) can offer specialized expertise and resources for eradicating security incidents that may exceed internal capabilities. These arrangements should clearly define the scope of authority, procedures, and communication protocols for when and how third parties can take eradication actions within your environment.
Evidence of fulfillment could include signed service level agreements (SLAs) with security service providers, documented incident response procedures that specify third-party roles and responsibilities, or authorization matrices showing which third parties have permission to perform specific eradication actions in your systems.
Implementation Example
Allow a third party (e.g., managed security service provider) to perform eradication actions on behalf of the organization
ID: RS.MI-02.345
Context
- Function
- RS: RESPOND
- Category
- RS.MI: Incident Mitigation
- Sub-Category
- Incidents are eradicated
Related questions
- Do your cybersecurity technologies and security features in other systems automatically perform containment actions when threats are detected?
- Does your incident response process allow responders to manually select and execute containment actions during security incidents?
- Does your organization have formal agreements with third parties (e.g., ISPs, MSSPs) authorizing them to perform containment actions during security incidents?
- Does your organization automatically transfer compromised endpoints to a remediation VLAN for isolation and remediation?
- Does your organization implement automated eradication capabilities within cybersecurity technologies and security features of other technologies?
- Does your incident response system allow authorized responders to manually select and execute eradication actions during security incidents?