Treatment process and documentation of occurred security incidents

Critical
High
Normal
Low

All security incidents are addressed in a consistent manner to improve security based on what has happened.

In the incident treatment process:

  • the reported incident is confirmed (or found unnecessary to record)
  • the type and cause of incident is documented
  • the risks associated with the incident are documented
  • the risks are re-evaluated and treated if that is necessary after the incident
  • risk mitigation measures or a decision their acceptance is documented
  • people who need to be informed of the results of the incident treatment are identified (including external ones)
  • possible need for a post-incident analysis is determined
Connected other frameworks and requirements:
T06: Turvallisuuspoikkeamien hallinta
32. Security of processing
GDPR
12. Transparent information, communication and modalities for the exercise of the rights of the data subject
GDPR
16.1.5: Response to information security incidents
ISO 27001
DE.AE-2: Analyze detected events
NIST CSF

Developing an incident response plan for critical information systems

Critical
High
Normal
Low

The organization shall establish a incident response plan for security incidents to critical information systems. Response plans should also be tested by the necessary organizational elements. The plan should take into account at least:

  • The purpose of the information system and the precautions to be taken in the event of its disruption
  • Recovery plans, targets, and priorities for the order of recovery of assets
  • The role of implementing the response plans and the contact details of the persons assigned to the roles
  •  Continuation of normal operations regardless of the state of the information systems.
  • Distribution, approval and review of response plans

In addition, the plan should at least:

  • Establish a roadmap for developing disruption management capacity
  • Describe the structure and organization of incident management capability
  • Provides metrics to measure incident management capability
Connected other frameworks and requirements:
RS.RP: Response Planning
NIST CSF
RS.RP-1: Incident response plan
NIST CSF

The first level response process to security incidents

Critical
High
Normal
Low

The organization has defined a process and the team involved in responding promptly to security incidents and deciding on the appropriate actions.

The first level response process includes at least:

  • effectively seeking to confirm the identified incident
  • deciding on the need for immediate response
Connected other frameworks and requirements:
16.1.4: Assessment of and decision on information security events
ISO 27001
DE.AE-4: Impact of events
NIST CSF
RS.RP: Response Planning
NIST CSF
RS.RP-1: Incident response plan
NIST CSF
RS.AN-4: Incident categorization
NIST CSF
No items found.