id: "IR-04(06)" title: "Insider Threats" family: "IR" family_name: "Incident Response" sort_id: "ir-04.06" priority: "P2" implementation_level: "organization" parent: "IR-04" enhancement: True
Statement
Implement an incident handling capability for incidents involving insider threats.
Guidance
Explicit focus on handling incidents involving insider threats provides additional emphasis on this type of threat and the need for specific incident handling capabilities to provide appropriate and timely responses.
Assessment Objective
an incident handling capability is implemented for incidents involving insider threats.
Incident response policy
procedures addressing incident handling
mechanisms supporting incident handling
system design documentation
system configuration settings and associated documentation
incident response plan
system security plan
audit records
other relevant documents or records
Organizational personnel with incident handling responsibilities
organizational personnel with information security responsibilities
Incident handling capability for the organization