Assign key roles and responsibilities for incident response, including staff from incident responders,
analysts, and relevant third parties. Review annually, or when significant enterprise changes occur
that could impact this Safeguard.
The organization shall ensure that clear persons are assigned to incident management responsibilities, e.g. handling the first response for incidents.
Incident management personnel need to be instructed and trained to understand the organization's priorities in dealing with security incidents.
The organization should create and maintain incident response plans. The response plans should include at least: