RS.MA-01 Incident response plan executed
Executing the incident response plan with relevant third parties once an incident is declared: automatic reporting, outsourced response assistance, an incident lead and activation of continuity plans.
RS.MA Incident management
Incident Management: executing the response plan, triage, categorization and prioritization, escalation and recovery initiation; five Subcategories.
RS.MA-02 Incident triage and validation
Triaging and validating incident reports: confirming they are cybersecurity-related and need a response, and estimating severity with defined criteria.
RS.MA-03 Incident categorization and prioritization
Categorizing incidents by type such as data breach, ransomware, DDoS or account compromise, prioritizing them by scope and impact, and choosing a response strategy.
RS.MA-04 Incident escalation
Escalating or elevating incidents as needed, tracking the status of all open incidents and coordinating escalation with designated internal and external stakeholders.
RS.MA-05 Recovery initiation criteria
Applying criteria to decide when to start incident recovery, weighing the operational disruption that recovery activities may cause.
