ADR-4 - Cybersecurity Event and/or Incident Handling
Control for security incident response and management
Control Definition
A structured incident response process must be defined covering detection, classification, containment, eradication, recovery and closure, with response times matching severity, and an incident response team set up with defined roles and the availability to handle the most critical incidents. Up-to-date playbooks must be maintained for the most frequent scenarios, including mass mitigation plans for widespread credential compromise, and clear channels established for staff to report suspicious events. Incident evidence must be preserved, ensuring the chain of custody, connections with specialized industry communities maintained, and post-mortem analyses carried out to generate lessons learned that strengthen controls and update playbooks.
Requirements
Requirement 1
We define a structured incident response process with formal stages: detection, analysis, classification, containment, eradication, recovery and closure.
Requirement 2
We classify incidents by severity (P1 critical, P2 high, P3 medium, P4 low) with defined maximum initial response and resolution times.
Requirement 3
We set up an incident response team (IRT/CSIRT) with assigned roles and responsibilities.
Requirement 4
We ensure 24/7 availability of the response team for P1 and P2 severity incidents.
Requirement 5
We maintain documented, up-to-date response playbooks for the most frequent incident types: ransomware, targeted phishing, unauthorized access, data leaks and privileged account compromise.
Requirement 6
In each playbook we define the specific containment, eradication and recovery steps.
Requirement 7
We establish escalation thresholds and the criteria for notifying regulators within the applicable legal deadlines.
Requirement 8
We establish and maintain active connections with specialized groups, forums and professional associations in the information security field.
Requirement 9
We provide a clear, accessible channel for staff to report any observed or suspected security event in a timely manner.
Requirement 10
We establish procedures to identify, collect, acquire and preserve evidence related to information security events and incidents.
Requirement 11
We apply evidence management procedures to all security events and incidents, ensuring the integrity of the chain of custody.
Requirement 12
We define and maintain initial mass identity protection mitigation plans that allow actions to be carried out at scale in the event of widespread credential compromise, including forced mass password resets, mass MFA enablement and blocking of compromised accounts.
Requirement 13
We perform a mandatory post-mortem analysis for all P1 and P2 severity incidents.
Requirement 14
We update playbooks after each significant incident, incorporating the lessons learned.
Requirement 15
We identify and record lessons learned for all P1 and P2 severity incidents.
Requirement 16
We use the lessons learned from security incidents to strengthen and improve existing security controls beyond updating playbooks.