a. Develop, document, and disseminate to {{ insert: param, ir-1_prm_1 }}: 1. {{ insert: param, ir-01_odp.03 }} incident response policy that: (a) Addresses purpose, scope, roles, respon...

a. Provide incident response training to system users consistent with assigned roles and responsibilities: 1. Within {{ insert: param, ir-02_odp.01 }} of assuming an incident response role or...

Incorporate simulated events into incident response training to facilitate the required response by personnel in crisis situations.

Provide an incident response training environment using {{ insert: param, ir-02.02_odp }}.

Provide incident response training on how to identify and respond to a breach, including the organization’s process for reporting a breach.

Test the effectiveness of the incident response capability for the system {{ insert: param, ir-03_odp.01 }} using the following tests: {{ insert: param, ir-03_odp.02 }}.

Test the incident response capability using {{ insert: param, ir-03.01_odp }}.

Coordinate incident response testing with organizational elements responsible for related plans.

Use qualitative and quantitative data from testing to: (a) Determine the effectiveness of incident response processes; (b) Continuously improve incident response processes; and (c) Provide in...

a. Implement an incident handling capability for incidents that is consistent with the incident response plan and includes preparation, detection and analysis, containment, eradication, and recov...

Support the incident handling process using {{ insert: param, ir-04.01_odp }}.

Include the following types of dynamic reconfiguration for {{ insert: param, ir-04.02_odp.02 }} as part of the incident response capability: {{ insert: param, ir-04.02_odp.01 }}.

Identify {{ insert: param, ir-04.03_odp.01 }} and take the following actions in response to those incidents to ensure continuation of organizational mission and business functions: {{ insert: param...

Correlate incident information and individual incident responses to achieve an organization-wide perspective on incident awareness and response.

Implement a configurable capability to automatically disable the system if {{ insert: param, ir-04.05_odp }} are detected.

Implement an incident handling capability for incidents involving insider threats.

Coordinate an incident handling capability for insider threats that includes the following organizational entities {{ insert: param, ir-04.07_odp }}.

Coordinate with {{ insert: param, ir-04.08_odp.01 }} to correlate and share {{ insert: param, ir-04.08_odp.02 }} to achieve a cross-organization perspective on incident awareness and more effective...

Employ {{ insert: param, ir-04.09_odp }} to respond to incidents.

Coordinate incident handling activities involving supply chain events with other organizations involved in the supply chain.

Establish and maintain an integrated incident response team that can be deployed to any location identified by the organization in {{ insert: param, ir-04.11_odp }}.

Analyze malicious code and/or other residual artifacts remaining in the system after the incident.

Analyze anomalous or suspected adversarial behavior in or related to {{ insert: param, ir-04.13_odp }}.

Establish and maintain a security operations center.

(a) Manage public relations associated with an incident; and (b) Employ measures to repair the reputation of the organization.

Track and document incidents.

Track incidents and collect and analyze incident information using {{ insert: param, ir-5.1_prm_1 }}.

a. Require personnel to report suspected incidents to the organizational incident response capability within {{ insert: param, ir-06_odp.01 }} ; and b. Report incident information to {{ insert:...

Report incidents using {{ insert: param, ir-06.01_odp }}.

Report system vulnerabilities associated with reported incidents to {{ insert: param, ir-06.02_odp }}.

Provide incident information to the provider of the product or service and other organizations involved in the supply chain or supply chain governance for systems or system components related to th...

Provide an incident response support resource, integral to the organizational incident response capability, that offers advice and assistance to users of the system for the handling and reporting o...

Increase the availability of incident response information and support using {{ insert: param, ir-07.01_odp }}.

(a) Establish a direct, cooperative relationship between its incident response capability and external providers of system protection capability; and (b) Identify organizational incident respon...

a. Develop an incident response plan that: 1. Provides the organization with a roadmap for implementing its incident response capability; 2. Describes the structure and organization of th...

Include the following in the Incident Response Plan for breaches involving personally identifiable information: (a) A process to determine if notice to individuals or other organizations, includi...

Respond to information spills by: a. Assigning {{ insert: param, ir-09_odp.01 }} with responsibility for responding to information spills; b. Identifying the specific information involved in th...

Provide information spillage response training {{ insert: param, ir-09.02_odp }}.

Implement the following procedures to ensure that organizational personnel impacted by information spills can continue to carry out assigned tasks while contaminated systems are undergoing correcti...

Employ the following controls for personnel exposed to information not within assigned access authorizations: {{ insert: param, ir-09.04_odp }}.