Policy 7230A - Department of Administration

8.1.2.e IR Plan Update Scheduling and Frequency
• IR plans should be reviewed and updated on an at least annual
basis or at such time as IR testing or IR operations indicate a
deficiency in the IR plan.
8.1.3. Test the Plan
To ensure the applicability of the plan and to verify that the plan can be acted
upon as created, periodic testing should be performed:
8.1.3.a IR Testing Methodologies
• The following capabilities should be included in the IR testing
program:
o Recognition of externally and internally sourced
incidents.
o Analysis to gather incident identification information.
o Application of containment and eradication tasks
appropriate to the type of incident.
o Restoration of normal operations.
o Co-ordination and communications.
• IR testing can be conducted in one of two ways:
o Classroom or tabletop exercises walkthrough IR
operations without any IR operations occurring.
o Functional or simulation exercises recreate actual
incidents and require the execution of IR operations.
8.1.3.b IR Testing Scheduling and Frequency
• Classroom or tabletop exercises should be performed on at
least an annual basis.
• Functional or simulation exercises should be performed on at
least a tri-annual basis.
8.2. Operate the Plan
No applicable Non-Mandatory Baselines.
8.3. Maintain Records
Agencies should capture documentation appropriate to all incident response
processes:
• Document and retain copies of incident response roles, responsibilities,
assigned individuals and appropriate contact information.
• Document and retain copies of incident response training materials.
• Document and retain copies of the incident response plan, including
preparatory materials.
• Document and retain copies of completed incident response tests.
27