Treatment process and documentation of occurred security incidents

Critical
High
Normal
Low

All security incidents are addressed in a consistent manner to improve security based on what has happened.

In the incident treatment process:

  • the reported incident is confirmed (or found unnecessary to record)
  • the type and cause of incident is documented
  • the risks associated with the incident are documented
  • the risks are re-evaluated and treated if that is necessary after the incident
  • risk mitigation measures or a decision their acceptance is documented
  • people who need to be informed of the results of the incident treatment are identified (including external ones)
  • possible need for a post-incident analysis is determined
Connected other frameworks and requirements:
T06: Turvallisuuspoikkeamien hallinta
32. Security of processing
GDPR
12. Transparent information, communication and modalities for the exercise of the rights of the data subject
GDPR
16.1.5: Response to information security incidents
ISO 27001
DE.AE-2: Analyze detected events
NIST CSF

The first level response process to security incidents

Critical
High
Normal
Low

The organization has defined a process and the team involved in responding promptly to security incidents and deciding on the appropriate actions.

The first level response process includes at least:

  • effectively seeking to confirm the identified incident
  • deciding on the need for immediate response
Connected other frameworks and requirements:
16.1.4: Assessment of and decision on information security events
ISO 27001
DE.AE-4: Impact of events
NIST CSF
RS.RP: Response Planning
NIST CSF
RS.RP-1: Incident response plan
NIST CSF
RS.AN-4: Incident categorization
NIST CSF
No items found.