Respons Insiden
Membangun dan menjalankan proses respons insiden.
Respons Insiden didefinisikan oleh hasil-hasil NIST CSF 2.0 RS.MA-01 (The incident response plan is executed in coordination with relevant third parties once an incident is declared); RS.MA-02 (Incident reports are triaged and validated); RS.MA-03 (Incidents are categorized and prioritized); RS.MA-04 (Incidents are escalated or elevated as needed); ID.IM-04 (Incident response plans and other cybersecurity plans that affect operations are established, communicated, maintained, and improved). Crosswalk Dipetakan melalui crosswalk yang dipublikasikan dalam ISO 27001, CIS v8.1, PCI DSS, CMMC, 800-53, HIPAA dan NIS2. Editorial Dipetakan secara editorial dalam SOC 2, GDPR, Essential Eight, DORA dan CPS 234. Tidak ada pemetaan dalam data kami Tidak ada pemetaan dalam data kami untuk Cyber Essentials.
| Kerangka kerja | Persyaratan | Judul | Tautan | Sumber / alasan |
|---|---|---|---|---|
| NIST CSF 2.0 | RS.MA-01RS.MA-02RS.MA-03RS.MA-04ID.IM-04 | The incident response plan is executed in coordination with relevant third parties once an incident is declared; Incident reports are triaged and validated; Incidents are categorized and prioritized… | Definisi topik | RS.MA-01 RS.MA-02 RS.MA-03 RS.MA-04 ID.IM-04 |
| ISO 27001 | A.5.24A.5.25A.5.26 | Information security incident management planning and preparation; Assessment and decision on information security events; Response to information security incidents | Crosswalk | A.5.24: via RS.MA-02; ID.IM-04; NIST 800-53 map: IR-8 A.5.25: via RS.MA-03; NIST 800-53 map: IR-4 A.5.26: via RS.MA-01; RS.MA-02; RS.MA-04; ID.IM-04; NIST 800-53 map: IR-4 |
| CIS v8.1 | CIS 17.1CIS 17.4CIS 17.5CIS 17.7CIS 17.9 | Designate Personnel to Manage Incident Handling; Establish and Maintain an Incident Response Process; Assign Key Roles and Responsibilities… | Crosswalk | CIS 17.1: Designate personnel to manage incident handling; not in CIS's own crosswalk to CSF 2.0, which covers 49 of 153 safeguards. CIS 17.4: via RS.MA-01 CIS 17.5: Assign key roles and responsibilities for incident response, including legal, IT, security and communications. CIS 17.7: Routine incident response exercises and scenarios to test the plan and staff. CIS 17.9: Editorial (CIS's published crosswalk covers 49 of 153 safeguards): security incident thresholds that trigger the response process. |
| SOC 2 | CC7.4CC7.3 | Responding to identified security incidents; Evaluating security events to determine if they are incidents | Editorial | AICPA's TSC mappings are not openly licensed; ControlMapping editorial mapping (criterion summaries are ours, not AICPA text). |
| PCI DSS | 12.10.112.10.312.10.212.10.4 | Incident response plan ready to activate; Incident response staff available around the clock; Incident response plan reviewed and tested annually… | Crosswalk | 12.10.1: via RS.MA-01; RS.MA-02; RS.MA-03; RS.MA-04; ID.IM-04 12.10.3: via RS.MA-01; RS.MA-04; ID.IM-04 12.10.2: via RS.MA-01; RS.MA-03; RS.MA-04; ID.IM-04 12.10.4: via RS.MA-02 |
| CMMC | IR.L2-3.6.1IR.L2-3.6.3 | Incident Handling; Incident Response Testing | Crosswalk | IR.L2-3.6.1: via 800-171r3 03.06.01 ↔ RS.MA-02, RS.MA-03, RS.MA-04 → IR-4; 800-171r2 Appendix D → IR-4 IR.L2-3.6.3: Test the organizational incident response capability. |
| 800-53 | IR-4IR-8IR-2IR-3 | Incident Handling; Incident Response Plan; Incident Response Training… | Crosswalk | IR-4: via RS.MA-02; RS.MA-03; RS.MA-04 IR-8: via RS.MA-01; ID.IM-04 IR-2: Incident response training for the people who run the plan; NIST links IR-2 to PR.AT outcomes rather than RS.MA. IR-3: Testing incident response capability; NIST links IR-3 to ID.IM-02 (improvements from tests) rather than the RS.MA outcomes. |
| HIPAA | §164.308(a)(6)§164.308(a)(6)(ii) | Security Incident Procedures; Response and Reporting | Crosswalk | §164.308(a)(6): via NIST HIPAA map: IR-4 §164.308(a)(6)(ii): via NIST HIPAA map: IR-4, IR-8 |
| GDPR | Art.33(1)Art.33(5) | Notification of a personal data breach to the supervisory authority; Notification of a personal data breach to the supervisory authority | Editorial | No official crosswalk exists for GDPR; ControlMapping editorial mapping. |
| NIS2 | 3.13.5 | Incident handling policy; Incident response | Crosswalk | 3.1: via RS.MA-01; ENISA ISO map: A.5.24 3.5: via RS.MA-01; RS.MA-02; RS.MA-03; RS.MA-04; ENISA ISO map: A.5.26 |
| Essential Eight | ISM-1819 | Following the identification of a cyber security incident, the cyber security incident… | Editorial | ISM-1819: ASD assigns these ISM controls to the Essential Eight; ASD publishes no crosswalk to NIST or ISO, so linking them to topics is ControlMapping editorial. |
| DORA | Art.17(1)Art.17(3)Art.11(2)(b)Art.18(1) | ICT-related incident management process; ICT-related incident management process; Response and recovery… | Editorial | Art.17(1): An ICT-related incident management process to detect, manage and notify incidents. Art.17(3): Early warning indicators, classification, roles, communication, escalation and response procedures. Art.11(2)(b): Respond to and resolve ICT-related incidents quickly, limiting damage. Art.18(1): Classify ICT-related incidents and determine their impact using the regulation's criteria: clients affected, duration, geographical spread, data losses, criticality and economic impact. |
| CPS 234 | Para 23Para 24Para 25Para 26 | Detect and respond to incidents in a timely manner; Maintain information security response plans; Response plans cover all stages and escalation… | Editorial | Para 23: Robust mechanisms to respond to information security incidents in a timely manner. Para 24: Response plans for incidents that could plausibly occur. Para 25: Plans cover every stage from detection to post-incident review, and escalation. Para 26: Review and test response plans annually. |
| Cyber Essentials | — | Tidak ada persyaratan | Tidak ada pemetaan dalam data kami | Tidak ada persyaratan Cyber Essentials yang dipetakan ke topik ini dalam data kami. |
Definisi topik Hasil CSF 2.0 yang mendefinisikan topik ini · Crosswalk setidaknya satu pilihan didukung crosswalk yang dipublikasikan · Editorial Penilaian ControlMapping, beserta alasannya · belum dipetakan, hanya berbagi hasil CSF untuk topik ini · Tidak ada pemetaan dalam data kami belum ada yang dipetakan dalam data kami; sering kali pekerjaan baru, tetapi periksa catatan cakupannya. Metodologi.
ID dan judul persyaratan ditampilkan sebagaimana diterbitkan masing-masing framework, dalam bahasa Inggris.
Pemetaan salah atau belum ada? Laporkan
Tentang Respons Insiden
Program respons insiden menyediakan proses dan prosedur terstruktur yang diikuti organisasi untuk mendeteksi, membatasi, memberantas, dan memulihkan diri dari insiden keamanan siber. Rencana respons insiden sebaiknya mendefinisikan tingkat keparahan, peran dan tanggung jawab, protokol komunikasi, prosedur eskalasi, serta integrasi dengan tim hukum, komunikasi, dan eksekutif. Latihan meja (tabletop) dan simulasi insiden secara berkala menguji efektivitas rencana, mengidentifikasi kesenjangan, dan memastikan anggota tim dapat menjalankan tanggung jawab mereka di bawah tekanan ketika insiden nyata terjadi.