Policy 7230A - Department of Administration

8. Incident Response
These Incident Response Non-Mandatory Baselines support the Enterprise Security Policy
(ITEC 7230 Rev 1), the Computer Incident Response Policy (ITEC 7320) and the IT Security
Response Protocols (ITEC 7320A).
Mandatory
Non-Mandatory
Procedures Baselines Procedures Baselines
8. Incident Response
8.1. Incident Response
8.1.1. Build a Team and Provide Training (4 sets) (4 sets)
8.1.2. Build an Incident Response Capability (4 sets) (5 sets)
8.1.3. Test the Plan (3 sets) (2 sets)
8.1.4. Operate the Plan (5 sets) (3 sets)
8.2. Maintain Records
8.1. Incident Response
The following are the Non-Mandatory Baselines that support the Incident Response
section of the Default Security Requirements:
8.1.1. Build a Team and Provide Training
Incident response is a security control that requires specialized capabilities.
Building a team ensures those capabilities are always appropriately provided
for:
8.1.1.a Incident Response (IR) Responsibilities
• Communications and coordination skills are required to
manage the various team members and activities and to share
information with employees of the organization outside of the
IR team.
• Network management skills are required to ensure network
functionality and availability during an incident as well as to
understand the impact of the incident in regard to network
functions.
• Systems management skills are required to ensure system
functionality and availability during an incident as well as to
understand the impact of the incident in regard to system
functions.
• Security management skills are required to ensure security
infrastructure functionality and availability during an incident
as well as to understand the impact of the incident in regard
to security functions.
24