Incident Response Management

Prior to or when security measures fail, it is essential to have in place several response strategies.

Create an incident response plan that can immediately protect digital assets in the event of an attack, breach, or penetration. The incident response plan should include (but is not limited to):

Procedures to initially identify and document an incident

Procedures that will inform tactical operational managers, internal and external stakeholders, and/or individuals affected

Procedures to investigate the breach, to mitigate harm to individuals, and to protect against further breaches

Enforcement mechanisms for breaches and non-adherences

Procedures to assess the damage to the organization and estimate both the damage cost and the cost of the containment efforts

Procedures to review response and update policies