Policy 7230A - Department of Administration

8. Incident Response
These Incident Response Mandatory Procedures support the Enterprise Security Policy (ITEC
7230 Rev 1), the Computer Incident Response Policy (ITEC 7320) and the IT Security
Response Protocols (ITEC 7320A).
Mandatory
Non-Mandatory
Procedures Baselines Procedures Baselines
8. Incident Response
8.1. Incident Response
8.1.1. Build a Team and Provide Training (4 sets) (4 sets)
8.1.2. Build an Incident Response Capability (4 sets) (5 sets)
8.1.3. Test the Plan (3 sets) (2 sets)
8.1.4. Operate the Plan (5 sets) (3 sets)
8.2. Maintain Records
8.1. Incident Response
The following are the Mandatory Procedures that support the Incident Response
section of the Default Security Requirements:
8.1.1. Build a Team and Provide Training
No applicable Mandatory Procedures.
8.1.2. Build an Incident Response Capability
No applicable Mandatory Procedures.
8.1.3. Test the Plan
No applicable Mandatory Procedures.
8.1.4. Operate the Plan
Should a potential threat be detected it must be analyzed to determine if an
incident has occurred and then the plan must be executed to minimize the
harm inflicted by the incident:
8.1.4.1 Detect Incidents to Identify Threats
Before incidents can be responded to, they must be detected.
Building standard categorizations can simplify detection and speed
subsequent incident response processes:
• Monitor systems for signs of incidents (see section 6.2.1 of the
Non-Mandatory Procedures).
• Categorize incidents according to established standards in
order to establish appropriate analysis, containment,
eradication and recovery processes.
18