id: "IR-04(01)" title: "Automated Incident Handling Processes" family: "IR" family_name: "Incident Response" sort_id: "ir-04.01" priority: "P2" implementation_level: "organization" parent: "IR-04" enhancement: True


Statement

Support the incident handling process using {{ insert: param, ir-04.01_odp }}.

Guidance

Automated mechanisms that support incident handling processes include online incident management systems and tools that support the collection of live response data, full network packet capture, and forensic analysis.

Assessment Objective

the incident handling process is supported using {{ insert: param, ir-04.01_odp }}.

Incident response policy

procedures addressing incident handling

automated mechanisms supporting incident handling

system design documentation

system configuration settings and associated documentation

system audit records

incident response plan

system security plan

other relevant documents or records

Organizational personnel with incident handling responsibilities

organizational personnel with information security responsibilities

Automated mechanisms that support and/or implement the incident handling process