CyberStrikeus/CyberStrike - Page 111

rc-co-03-rcco-03

Recovery activities and progress in restoring operational capabilities are communicated to designated internal and external stakeholders

rc-co-04-rcco-04

Public updates on incident recovery are shared using approved methods and messaging

rc-im-01-rcim-01

Recovery plans incorporate lessons learned

rc-im-02-rcim-02

Recovery strategies are updated

rc-rp-01-rcrp-01

The recovery portion of the incident response plan is executed once initiated from the incident response process

rc-rp-02-rcrp-02

Recovery actions are selected, scoped, prioritized, and performed

rc-rp-03-rcrp-03

The integrity of backups and other restoration assets is verified before using them for restoration

rc-rp-04-rcrp-04

Critical mission functions and cybersecurity risk management are considered to establish post-incident operational norms

rc-rp-05-rcrp-05

The integrity of restored assets is verified, systems and services are restored, and normal operating status is confirmed

rc-rp-06-rcrp-06

The end of incident recovery is declared based on criteria, and incident-related documentation is completed

improvements-rs-im-improvements

Improvements

incident-analysis-rs-an-incident-analysis

Investigations are conducted to ensure effective response and support forensics and recovery activities

incident-management-rs-ma-incident-management

Responses to detected cybersecurity incidents are managed

incident-mitigation-rs-mi-incident-mitigation

Activities are performed to prevent expansion of an event and mitigate its effects

response-planning-rs-rp-response-planning

Response Planning

rs-an-01-rsan-01

Notifications from detection systems are investigated

rs-an-02-rsan-02

The impact of the incident is understood

rs-an-03-rsan-03

Analysis is performed to establish what has taken place during an incident and the root cause of the incident

rs-an-04-rsan-04

Incidents are categorized consistent with response plans

rs-an-05-rsan-05

Processes are established to receive, analyze and respond to vulnerabilities disclosed to the organization from internal and external sources (e.g.

rs-an-06-rsan-06

Actions performed during an investigation are recorded, and the records' integrity and provenance are preserved

rs-an-07-rsan-07

Incident data and metadata are collected, and their integrity and provenance are preserved

rs-an-08-rsan-08

An incident's magnitude is estimated and validated

rs-co-01-rsco-01

Personnel know their roles and order of operations when a response is needed

rs-co-02-rsco-02

Internal and external stakeholders are notified of incidents

rs-co-03-rsco-03

Information is shared with designated internal and external stakeholders

rs-co-04-rsco-04

Coordination with stakeholders occurs consistent with response plans

rs-co-05-rsco-05

Voluntary information sharing occurs with external stakeholders to achieve broader cybersecurity situational awareness

rs-im-01-rsim-01

Response plans incorporate lessons learned

rs-im-02-rsim-02

Response strategies are updated

rs-ma-01-rsma-01

The incident response plan is executed in coordination with relevant third parties once an incident is declared

rs-ma-02-rsma-02

Incident reports are triaged and validated

rs-ma-03-rsma-03

Incidents are categorized and prioritized

rs-ma-04-rsma-04

Incidents are escalated or elevated as needed

rs-ma-05-rsma-05

The criteria for initiating incident recovery are applied

rs-mi-01-rsmi-01

Incidents are contained

rs-mi-02-rsmi-02

Incidents are eradicated

rs-mi-03-rsmi-03

Newly identified vulnerabilities are mitigated or documented as accepted risks

rs-rp-01-rsrp-01

Response plan is executed during or after an incident

access-enforcement-03-01-02-access-enforcement

Access Enforcement