NIS2 Implementing Regulation

Requirement

3.1: Incident handling policy

Oh no! No description found. But not to worry. Read from Tasks below how to advance this topic.

1. For the purpose of Article 21(2), point (b) of Directive (EU) 2022/2555, the relevant entities shall establish and implement an incident handling policy laying down the roles, responsibilities, and procedures for detecting, analysing, containing or responding to, recovering from, documenting and reporting of incidents in a timely manner.

2. The policy referred to in point 3.1.1 shall be coherent with the business continuity and disaster recovery plan referred to in point 4.1. The policy shall include:

a categorisation system for incidents that is consistent with the event assessment and classification carried out pursuant to point 3.4.1;
effective communication plans including for escalation and reporting;
assignment of roles to detect and appropriately respond to incidents to competent employees;
documents to be used in the course of incident detection and response such as incident response manuals, escalation charts, contact lists and templates.

3. The roles, responsibilities and procedures laid down in the policy shall be tested and reviewed and, where appropriate, updated at planned intervals and after significant incidents or significant changes to operations or risks.

Fulfill this requirement by completing the tasks below ->

This requirement is part of the framework:

NIS2 Implementing Regulation

Other requirements of the framework

3.1: Incident handling policy

Best practices

How to implement:

3.1: Incident handling policy

This policy on

3.1: Incident handling policy

provides a set concrete tasks you can complete to secure this topic. Follow these best practices to ensure compliance and strengthen your overall security posture.

1. For the purpose of Article 21(2), point (b) of Directive (EU) 2022/2555, the relevant entities shall establish and implement an incident handling policy laying down the roles, responsibilities, and procedures for detecting, analysing, containing or responding to, recovering from, documenting and reporting of incidents in a timely manner.

2. The policy referred to in point 3.1.1 shall be coherent with the business continuity and disaster recovery plan referred to in point 4.1. The policy shall include:

a categorisation system for incidents that is consistent with the event assessment and classification carried out pursuant to point 3.4.1;
effective communication plans including for escalation and reporting;
assignment of roles to detect and appropriately respond to incidents to competent employees;
documents to be used in the course of incident detection and response such as incident response manuals, escalation charts, contact lists and templates.

3. The roles, responsibilities and procedures laid down in the policy shall be tested and reviewed and, where appropriate, updated at planned intervals and after significant incidents or significant changes to operations or risks.

Read below what concrete actions you can take to improve this ->

Frameworks that include requirements for this topic:

No items found.

How to improve security around this topic

In Cyberday, requirements and controls are mapped to universal tasks. A set of tasks in the same topic create a Policy, such as this one.

Here's a list of tasks that help you improve your information and cyber security related to

3.1: Incident handling policy

Task name

Priority

Task completes

Complete these tasks to increase your compliance in this policy.

Critical

No other tasks found.

Complete these tasks in Cyberday ISMS ->

How to comply with this requirement

In Cyberday, requirements and controls are mapped to universal tasks. Each requirement is fulfilled with one or multiple tasks.

Here's a list of tasks that help you comply with the requirement

3.1: Incident handling policy

of the framework

NIS2 Implementing Regulation

Task name

Priority

Task completes

Complete these tasks to increase your compliance in this policy.

Critical

Designation of an incident management team

Critical

High

Normal

Low

Incident management

Incident management and response

Designation of an incident management team

This task helps you comply with the following requirements

Članak 30.1.b: Postupanje s incidentima, uključujući njihovo praćenje, evidentiranje i prijavljivanje NIS2 Croatia

9.9b §: Poikkeamien käsittely Kyberturvallisuuslaki

1.6.2: Management of reported events TISAX

30 § 3.2° (incidents): La gestion des incidents NIS2 Belgium

4.1.1: Establish plans for incident management NSM ICT-SP

Creating and maintaining incident response plans

Critical

High

Normal

Low

Incident management

Incident management and response

Creating and maintaining incident response plans

This task helps you comply with the following requirements

4.1.1: Establish plans for incident management NSM ICT-SP

ID.IM-04: Incident response and cybersecurity plans NIST 2.0

PR.IR-03: Meeting resilience requirements NIST 2.0

RS.MA-01: Incident response plan execution NIST 2.0

RC.RP-01: Recovery plan NIST 2.0

Internal communication in an incident situation

Critical

High

Normal

Low

Incident management

Incident management and response

Internal communication in an incident situation

This task helps you comply with the following requirements

1.6.1: Reporting of security events TISAX

DE.AE-06: Information on adverse events NIST 2.0

RS.CO-02: Notifying stakeholders of incidents NIST 2.0

RS.CO-03: Sharing Information with stakeholders NIST 2.0

17.2: Establish and Maintain Contact Information for Reporting Security Incidents CIS 18

Incident management resourcing and monitoring

Critical

High

Normal

Low

Risk management and leadership

Cyber security management

Incident management resourcing and monitoring

This task helps you comply with the following requirements

24. Responsibility of the controller GDPR

7.2.1: Management responsibilities ISO 27001

16.1.1: Responsibilities and procedures ISO 27001

5.24: Information security incident management planning and preparation ISO 27001

Article 17: ICT-related incident management process DORA

Regular testing and review of continuity plans

Critical

High

Normal

Low

Risk management and leadership

Continuity management

Regular testing and review of continuity plans

This task helps you comply with the following requirements

Članak 30.1.c: Kontinuitet poslovanja NIS2 Croatia

9.10 §: Varmuuskopiointi ja jatkuvuuden hallinta Kyberturvallisuuslaki

5.2.8: IT service continuity planning TISAX

30 § 3.3°: La continuité et la gestion des crises NIS2 Belgium

4.1.6: Test and rehearse the plans regularly so that they are established NSM ICT-SP

Developing an incident response plan for critical information systems

Critical

High

Normal

Low

Risk management and leadership

Continuity management

Developing an incident response plan for critical information systems

This task helps you comply with the following requirements

RS.RP: Response Planning NIST

RS.RP-1: Incident response plan NIST

HAL-17: Tietojärjestelmien toiminnallinen käytettävyys ja vikasietoisuus Julkri

VAR-09: Tietojärjestelmien toipumissuunnitelmat Julkri

CC7.4: Responding to identified security incidents SOC 2

Complete these tasks in Cyberday ISMS ->

The ISMS component hierachy

When building an ISMS, it's important to understand the different levels of information hierarchy. Here's how Cyberday is structured.

Framework

Sets the overall compliance standard or regulation your organization needs to follow.

Requirements

Break down the framework into specific obligations that must be met.

Tasks

Concrete actions and activities your team carries out to satisfy each requirement.

Policies

Documented rules and practices that are created and maintained as a result of completing tasks.

Never duplicate effort. Do it once - improve compliance across frameworks.

Reach multi-framework compliance in the simplest possible way‍

Security frameworks tend to share the same core requirements - like risk management, backup, malware, personnel awareness or access management.

Cyberday maps all frameworks’ requirements into shared tasks - one single plan that improves all frameworks’ compliance.

Do it once - we automatically apply it to all current and future frameworks.

Start free trial