Incident Response Plan
What is Incident Response Plan?
A documented set of instructions that outlines an organisation's procedures for detecting, responding to, and recovering from security incidents. Required by frameworks including ISO 27001, NIST CSF, PCI DSS, and HIPAA.
Terms that appear alongside incident response plan
Each of these is named in at least one of the same controls as incident response plan. The number is how many controls name both.
- security incident 24 shared controls
- lessons learned 20 shared controls
- nist 19 shared controls
- cybersecurity 16 shared controls
- breach notification 11 shared controls
- integrity 10 shared controls
- incident reporting 10 shared controls
- remediation 9 shared controls
Frameworks that govern incident response plan
What the standards actually require on incident response plan
Requirements naming incident response plan across 6 standards, quoted from the control text.
The plan must require that the IAC incident response plan is put into action as soon as an IAC cyber incident is formally declared.
api-1164::RS.RP-1 · RS.RP-1 Incident response plan activated on official declaration →CSF 2.0 outcome: the incident response plan is executed in coordination with relevant third parties once an incident is declared. Priority High. R1: detection technologies should automatically report incidents they have confirmed.
nist-sp-800-61-rev-3::RS.MA-01 · RS.MA-01 Incident response plan executed with third parties once an incident is declared →On a cycle of no more than 12 months, the entity must review its security incident response plan, updating the content where needed, and must test it, with the test covering every element listed in Requirement 12.10.1.
12.10.2 · 12.10.2 Annual review and testing of the incident response plan →Incident response plans covering every phase of the incident lifecycle are established and maintained, so responses are repeatable and consistent under stress.
australian-energy-sector-cyber-security-framework-aescsf::RESPONSE-3d · RESPONSE-3d: Incident response plans cover the whole lifecycle →Following the identification of a cyber security incident, the cyber security incident response plan is enacted. Required at Maturity Levels Two and Three of the Application control mitigation strategy (Appendices B and C);
acsc-essential-eight::E8-APP-ISM-1819 · Application control (ISM-1819): Following the identification of a cyber security incident, the cyber security incident response plan is enacted →Following the identification of a cyber security incident, the cyber security incident response plan is enacted.
ISM-1819 · Enacting cyber security incident response plans →Questions people ask about incident response plan
What is Incident Response Plan?
Why is Incident Response Plan important for compliance?
Which compliance frameworks address Incident Response Plan?
Where can I learn more about Incident Response Plan?
See how Incident Response Plan applies across compliance frameworks
Our platform maps 1,016 frameworks with 316K cross-framework control mappings. Explore how this concept is addressed across standards.