Requirement
The entity responds to identified security incidents by executing a defined incident-response program to understand, contain, remediate, and communicate security incidents, as appropriate.
Points of Focus
Assigns Roles and Responsibilities
Requirement: Roles and responsibilities for the design, implementation, maintenance, and execution of the incident-response program are assigned, including the use of external resources when necessary.
Contains and Responds to Security Incidents
Requirement: Procedures are in place to respond to and contain security incidents that actively threaten entity objectives.
Mitigates Ongoing Security Incidents
Requirement: Procedures are in place to mitigate the effects of ongoing security incidents.
Resolves Security Incidents
Requirement: Procedures are in place to resolve security incidents through closure of vulnerabilities, removal of unauthorized access, and other remediation actions.
Restores Operations
Requirement: Procedures are in place to restore data and business operations to an interim state that permits the achievement of entity objectives.
Develops and Implements Communication of Security Incidents
Requirement: Protocols for communicating, in a timely manner, information regarding security incidents and actions taken to affected parties are developed and implemented to support the achievement of the entity's objectives.
Obtains Understanding of Nature of Incident and Determines Containment Strategy
Requirement: An understanding of the nature (for example, the method by which the incident occurred and the affected system resources) and severity of the security incident is obtained to determine the appropriate response and containment strategy, including (1) a determination of the appropriate response time frame, and (2) the determination and execution of the containment approach.
Remediates Identified Vulnerabilities
Requirement: Identified vulnerabilities are remediated through the development and execution of remediation activities.
Communicates Remediation Activities
Requirement: Remediation activities are documented and communicated in accordance with the incident-response program.
Evaluates the Effectiveness of Incident Response
Requirement: The design of incident-response activities is evaluated for effectiveness on a periodic basis.
Periodically Evaluates Incidents
Requirement: Periodically, management reviews incidents related to security, availability, processing integrity, confidentiality, and privacy and identifies the need for system changes based on incident patterns and root causes.
[P] Applies Breach Response Procedures
Requirement: Breach response procedures are defined and applied in the event of a confirmed privacy incident.
[P] Communicates Unauthorized Use and Disclosure
Requirement: Events that resulted in unauthorized use or disclosure of personal information are communicated to the data subjects, legal and regulatory authorities, and others as required.
[P] Application of Sanctions
Requirement: The conduct of individuals and organizations operating under the authority of the entity and involved in the unauthorized use or disclosure of personal information is evaluated and, if appropriate, sanctioned in accordance with entity policies and legal and regulatory requirements.
Explanation
When an incident is confirmed, the organization must execute a defined response program: assigned roles, containment, mitigation, remediation, and communication to affected parties. Auditors test whether the program exists on paper and in practice — reviewing incident tickets, response timelines, and evidence that lessons from past incidents feed back into the program.
