CIP-008-6: Cyber Security Incident response plans, testing every 15 months, plan maintenance after lessons learned, and mandatory reporting to the E-ISAC and the federal cyber incident center.
What the documented incident response plan must contain: identification and classification, criteria for Reportable incidents and attempts to compromise, roles and responsibilities, and incident handling procedures.
Testing each incident response plan at least every 15 calendar months, following the plan in real incidents and exercises, and keeping records of Reportable incidents and attempts to compromise.
Updating the plan and notifying responders within 90 days after a test or real incident, and within 60 days after changes to roles, teams or technology.
The mandatory reports to the E-ISAC and the federal cyber incident center: required content, the one-hour and next-day deadlines, and seven-day updates.
Tell us what you're working on, whether it's a deployment, an audit, a security test or a cyber range. You'll speak with an engineer who can help you scope it.