NIST Cybersecurity Framework: Respond Security Controls
Take action regarding a detected cybersecurity incident.
Incident Analysis
Investigate contributing factors to confirmed incidents
Understanding how an incident happened is just as important as stopping it. Investigations that surf...
The impact of the incident is understood
A declared incident may look small at first and reveal itself to be much larger under investigation....
Forensics are performed
Forensic analysis is how you answer the questions that matter most after an incident: how did the at...
Actions performed during an investigation are recorded, and the records' integrity and provenance are preserved
An incident investigation is itself a chain of events that needs to be documented. Without records o...
Incident data and metadata are collected, and their integrity and provenance are preserved
Incident data, the raw evidence gathered during an investigation, is the factual foundation of every...
Incident Response Reporting and Communication
Internal and external stakeholders are notified of incidents in a timely manner
Incident communication is an obligation, not an option. Internally, stakeholders need to know what i...
Information is shared with designated internal and external stakeholders
During an incident, information asymmetry creates risk. When security knows the full scope of an att...
Incident Management
Execute the incident response plan in coordination with relevant third parties
When an incident is declared, the response plan must be activated immediately and in sync with any e...
Triage and validate incident reports
Not every alert or report is a real incident. Triage is the process of quickly determining whether a...
Categorize and prioritize incidents
Confirmed incidents are not all equal. A phishing email caught before a click is very different from...
Escalate or elevate incidents as needed
Some incidents exceed the authority, expertise, or resources of the initial responders. Escalation e...
Apply the criteria for initiating incident recovery
Moving to recovery too early can reintroduce threats before they are fully eradicated, while waiting...