12 new national NIS2 framework versions published! Read more ->
Cyberday back to normal - related blog
MIL1 requirements
a. Criteria for declaring cybersecurity incidents are established, at least in an ad hoc manner
b. Cybersecurity events are analyzed to support the declaration of cybersecurity incidents, at least in an ad hoc manner
MIL2 requirements
c. Cybersecurity incident declaration criteria are formally established based on potential impact to the function
d. Cybersecurity events are declared to be incidents based on established criteria
e. Cybersecurity incident declaration criteria are updated periodically and according to defined triggers, such as organizational changes, lessons learned from plan execution, or newly identified threats
f. There is a repository where cybersecurity events and incidents are documented and tracked to closure
g. Internal and external stakeholders (for example, executives, attorneys, government agencies, connected organizations, vendors, sector organizations, regulators) are identified and notified of incidents based on situational awareness reporting requirements (SITUATION-3d)
MIL3 requirements
h. Criteria for cybersecurity incident declaration are aligned with cyber risk prioritization criteria (RISK-3b)
i. Cybersecurity incidents are correlated to identify patterns, trends, and other common features across multiple incidents
The organization has defined metrics that can be monitored and are related to cyber security incident management. At its best, good metrics help detect weaknesses in incident detection.
Possible metrics include:
The organization must define the threshold at which a security incident becomes a cyber security breach.
The organization shall define procedures for clearly sorting detected security events. Sorting must enable the prioritizing of events according to severity and potential impact.
Sorting is intended to enhance the investigation and evaluation of security events so that, for example, a response to a disruption can be initiated quickly.
Procedures can consist of common processes, technical tools, or algorithms that utilize machine learning. Procedures need to be reviewed regularly to ensure that they work and are appropriate for their needs.
.png)
