CC7.4
Points of Focus
Assigns Roles and Responsibilities
Roles and responsibilities for the design, implementation, maintenance, and execution of the incident response program are assigned, including the use of external resources when necessary.
Contains and Responds to Security Incidents
Procedures are in place to respond to and contain security incidents that actively threaten entity objectives.
Mitigates Ongoing Security Incidents
Procedures are in place to mitigate the effects of ongoing security incidents.
Resolves Security Incidents
Procedures are in place to resolve security incidents through closure of vulnerabilities, removal of unauthorized access, and other remediation actions.
Restores Operations
Procedures are in place to restore data and business operations to an interim state that permits the achievement of entity objectives.
Develops and Implements Communication of Security Incidents
Protocols for communicating, in a timely manner, information regarding security incidents and actions taken to affected parties are developed and implemented to support the achievement of the entity's objectives.
Obtains Understanding of Nature of Incident and Determines Containment Strategy
An understanding of the nature (for example, the method by which the incident occurred and the affected system resources) and severity of the security incident is obtained to determine the appropriate response and containment strategy, including- (1) a determination of the appropriate response time frame, and (2) the determination and execution of the containment approach.
Remediates Identified Vulnerabilities
Identified vulnerabilities are remediated through the development and execution of remediation activities.
Communicates Remediation Activities
Remediation activities are documented and communicated in accordance with the incident response program.
Evaluates the Effectiveness of Incident Response
The design of incident response activities is evaluated for effectiveness on a periodic basis.
Periodically Evaluates Incidents
Periodically, management reviews incidents related to security, availability, processing integrity, confidentiality, and privacy and identifies the need for system changes based on incident patterns and root causes.
Applies Breach Response Procedures
(For Trust Service Criteria of PRIVACY) Breach response procedures are defined and applied in the event of a confirmed privacy incident.
Communicates Unauthorized Use and Disclosure
(For Trust Service Criteria of PRIVACY) Events that resulted in unauthorized use or disclosure of personal information are communicated to the data subjects, legal and regulatory authorities, and others as required.
Application of Sanctions
(For Trust Service Criteria of PRIVACY) The conduct of individuals and organizations operating under the authority of the entity and involved in the unauthorized use or disclosure of personal information is evaluated and, if appropriate, sanctioned in accordance with entity policies and legal and regulatory requirements.
Evidence Requests
| Area of Focus | Artifact | Description |
|---|---|---|
| Incident Response | Incident Response Program (IRP) | Documented evidence of a Incident Response Plan (IRP). This is program-level documentation in the form of a runbook, playbook or a similar format provides guidance on organizational practices that support existing policies and standards. |
| Incident Response | Incident Tracking | Documented evidence of a centralized repository to track cybersecurity & data privacy incidents. |
| Incident Response | Formally Assigned Incident Response Roles & Responsibilities | Documented evidence of the establishment of a formally-assigned, integrated team of cybersecurity, IT and business function representatives that are capable of addressing cybersecurity & data privacy incident response operations. |
| Incident Response | Incident Reporting Capability | Documented evidence of a capability to provide situational awareness of incidents to internal stakeholders and generated necessary reporting to affected clients, applicable third-parties and regulatory authorities. |
| Risk Management | Supply Chain Risk Management (SCRM) Plan | Documented evidence of a Supply Chain Risk Management (SCRM) Plan. This is program-level documentation in the form of a playbook, concept of operations or a similar format provides guidance on organizational practices that support existing policies and standards. |
| Risk Management | Plan of Actions & Milestones (POA&M) / Risk Register | Documented evidence of a POA&M, or risk register, that tracks control deficiencies from identification through remediation. |
Policies
- Incident Management Policy - Establishes the framework for detecting, responding to, and recovering from security incidents
Example Organization Controls
- CC7.4.1 - Security events are analyzed to determine root cause and impact.
Example Control Objectives
- Incident response readiness - Security incidents are identified, responded to, and resolved in a timely manner with lessons learned.
Example Evidence
- Security Incident Documentation - Documentation of security incidents handled during audit period
Example Action Plans
- Incident response tabletop exercise - Semi-annual tabletop exercise to validate incident response procedures and team readiness.