RS.CO-01
Do personnel understand their specific roles, responsibilities, and the order of operations during a security incident response?
Explanation
Responder readiness is the focus: assessors want personnel to know their specific roles, responsibilities, and the order of operations to follow during a security incident. Effective incident response requires clear role definition and understanding of the escalation path to minimize confusion and response time during high-stress situations.
Evidence could include documented incident response plans with clearly defined roles and responsibilities, records of tabletop exercises or simulations, and signed acknowledgments from staff confirming they understand their specific incident response duties.
Context
- Function
- RS: RESPOND
- Category
- RS.CO: Incident Response Reporting and Communication
- Sub-Category
- Personnel know their roles and order of operations when a response is needed
Related questions
- Does your organization have documented breach notification procedures that include a process for notifying affected customers in the event of a data breach?
- Does your organization have documented procedures for notifying business partners and customers of security incidents in accordance with contractual obligations?
- Does your organization have documented procedures for notifying law enforcement and regulatory bodies of security incidents that include specific notification criteria and required management approvals?
- Does your organization have documented processes for securely sharing information during incident response that align with established information sharing agreements?
- Does your organization voluntarily share information about observed threat actor tactics, techniques, and procedures (TTPs) with an Information Sharing and Analysis Center (ISAC) or similar industry group after removing sensitive data?
- Does your organization have a documented process for notifying HR when malicious insider activity is detected?
