03.06.01 Incident handling
Running an incident-handling capability consistent with the incident response plan, covering preparation, detection and analysis, containment, eradication and recovery.
03.06 Incident response
Rev. 3 incident response requirements: the incident-handling capability, incident tracking and reporting, testing, role-based incident response training and the incident response plan.
03.06.02 Incident monitoring, reporting, and response assistance
Tracking and documenting incidents, reporting suspected incidents internally within a defined time and to defined authorities, and giving users a support resource for handling and reporting incidents.
03.06.03 Incident response testing
Testing the effectiveness of the incident response capability at a defined frequency, through checklists, walk-through or tabletop exercises and simulations.
03.06.04 Incident response training
Training system users in incident response duties that match their roles, within a defined time of taking on the role or gaining access, after system changes and at a defined frequency, with content kept current; new in Rev. 3.
03.06.05 Incident response plan
Writing, distributing, updating and protecting an incident response plan that maps out the incident response capability, defines reportable incidents, covers information sharing and assigns responsibilities; new in Rev. 3.
