Safeguard 17.1 Incident handling lead and backup
Designating a key person and at least one backup to manage incident handling, whether internal staff, a service provider or both, with internal oversight of any third party.
Control 17 Incident response management
CIS Control 17 covers building and maintaining an incident response capability: incident handling personnel, contact lists, workforce reporting, the response process, roles, communication mechanisms, exercises, post-incident reviews and incident thresholds.
Safeguard 17.2 Incident reporting contacts
Maintaining contact details for everyone who must be informed of a security incident, such as staff, vendors, law enforcement, insurers, agencies and ISAC partners, verified annually.
Safeguard 17.3 Workforce incident reporting process
The documented process for the workforce to report security incidents, covering timeframe, recipients, mechanism and minimum information, available to the whole workforce.
Safeguard 17.4 Incident response process
The documented incident response process addressing roles and responsibilities, compliance requirements and a communication plan; the IG2 plan that builds on the IG1 basics in 17.1 to 17.3.
Safeguard 17.5 Incident response roles
Assigning incident response roles and responsibilities across legal, IT, security, facilities, public relations, HR, responders and analysts, reviewed annually.
Safeguard 17.6 Incident communication mechanisms
Choosing primary and secondary ways to communicate during an incident, such as phone, email, secure chat or letters, allowing for channels like email being compromised.
Safeguard 17.7 Incident response exercises
Planning and running incident response exercises and scenarios for key personnel that test communication, decisions and workflows, at least annually.
Safeguard 17.8 Post-incident reviews
Running post-incident reviews that capture lessons learned and follow-up actions to prevent recurrence.
Safeguard 17.9 Security incident thresholds
Defining security incident thresholds that at minimum separate incidents from events, with examples like abnormal activity, vulnerabilities, breaches and privacy incidents; the only IG3 safeguard in Control 17.
