CyberStrikeus/CyberStrike - Page 127

ir-4-10-supply-chain-coordination

Coordinate incident handling activities involving supply chain events with other organizations involved in the supply chain.

ir-4-11-integrated-incident-response-team

Establish and maintain an integrated incident response team that can be deployed to any location identified by the organization in [organization-defin

ir-4-12-malicious-code-and-forensic-analysis

Analyze malicious code and/or other residual artifacts remaining in the system after the incident.

ir-4-13-behavior-analysis

Analyze anomalous or suspected adversarial behavior in or related to [organization-defined].

ir-4-14-security-operations-center

Establish and maintain a security operations center.

ir-4-15-public-relations-and-reputation-repair

Manage public relations associated with an incident;

ir-4-2-dynamic-reconfiguration

Include the following types of dynamic reconfiguration for [organization-defined] as part of the incident response capability: [organization-defined].

ir-4-3-continuity-of-operations

Identify [organization-defined] and take the following actions in response to those incidents to ensure continuation of organizational mission and bus

ir-4-4-information-correlation

Correlate incident information and individual incident responses to achieve an organization-wide perspective on incident awareness and response.

ir-4-5-automatic-disabling-of-system

Implement a configurable capability to automatically disable the system if [organization-defined] are detected.

ir-4-6-insider-threats

Implement an incident handling capability for incidents involving insider threats.

ir-4-7-insider-threats-intra-organization-coordination

Coordinate an incident handling capability for insider threats that includes the following organizational entities [organization-defined].

ir-4-8-correlation-with-external-organizations

Coordinate with [organization-defined] to correlate and share [organization-defined] to achieve a cross-organization perspective on incident awareness

ir-4-9-dynamic-response-capability

Employ [organization-defined] to respond to incidents.

ir-4-incident-handling

Implement an incident handling capability for incidents that is consistent with the incident response plan and includes preparation, detection and ...

ir-5-1-automated-tracking-data-collection-and-analysis

Track incidents and collect and analyze incident information using [organization-defined].

ir-5-incident-monitoring

Track and document incidents.

ir-6-1-automated-reporting

Report incidents using [organization-defined].

ir-6-2-vulnerabilities-related-to-incidents

Report system vulnerabilities associated with reported incidents to [organization-defined].

ir-6-3-supply-chain-coordination

Provide incident information to the provider of the product or service and other organizations involved in the supply chain or supply chain governance

ir-6-incident-reporting

Require personnel to report suspected incidents to the organizational incident response capability within [organization-defined] ;

ir-7-2-coordination-with-external-providers

Establish a direct, cooperative relationship between its incident response capability and external providers of system protection capability;

ir-7-incident-response-assistance

Provide an incident response support resource, integral to the organizational incident response capability, that offers advice and assistance to users

ir-8-1-breaches

Include the following in the Incident Response Plan for breaches involving personally identifiable information: A process to determine if notice to in

ir-8-incident-response-plan

Develop an incident response plan that: Provides the organization with a roadmap for implementing its incident response capability; Describes the stru

ir-9-1-responsible-personnel

Responsible Personnel

ir-9-2-training

Provide information spillage response training [organization-defined].

ir-9-3-post-spill-operations

Implement the following procedures to ensure that organizational personnel impacted by information spills can continue to carry out assigned tasks whi

ir-9-4-exposure-to-unauthorized-personnel

Employ the following controls for personnel exposed to information not within assigned access authorizations: [organization-defined].

ir-9-information-spillage-response

Respond to information spills by: Assigning [organization-defined] with responsibility for responding to information spills; Identifying the specific

ma-1-policy-and-procedures

Develop, document, and disseminate to [organization-defined]: [organization-defined] maintenance policy that: Procedures to facilitate the implementat

ma-2-1-record-content

Record Content

ma-2-2-automated-maintenance-activities

Schedule, conduct, and document maintenance, repair, and replacement actions for the system using [organization-defined] ;

ma-2-controlled-maintenance

Schedule, document, and review records of maintenance, repair, and replacement on system components in accordance with manufacturer or vendor speci...

ma-3-1-inspect-tools

Inspect the maintenance tools used by maintenance personnel for improper or unauthorized modifications.

ma-3-2-inspect-media

Check media containing diagnostic and test programs for malicious code before the media are used in the system.

ma-3-3-prevent-unauthorized-removal

Prevent the removal of maintenance equipment containing organizational information by: Verifying that there is no organizational information contained

ma-3-4-restricted-tool-use

Restrict the use of maintenance tools to authorized personnel only.

ma-3-5-execution-with-privilege

Monitor the use of maintenance tools that execute with increased privilege.

ma-3-6-software-updates-and-patches

Inspect maintenance tools to ensure the latest software updates and patches are installed.