Policy 7230A - Department of Administration

8.2. Maintain Records
8.1.4.2 Analyze Discovered Threats
Once incidents have been detected analysis is required to determine
the appropriate manner in which to proceed with subsequent
incident response processes:
• Investigate discovered precursors and indicators to determine
if a valid threat may occur, is occurring or has occurred.
• Fully document all aspects of the incident and incident
response.
• Prioritize the Agency’s response to incidents according to
potential impact.
• Notify appropriate individuals within the organization once
the threat has been validated and prioritized.
8.1.4.3 Contain Threats to Minimize Loss and Maintain Operations
Once incidents have been understood and response prioritized the
threat associated with the incident must be contained to prevent
impact to other systems and thus minimize overall impact:
• Select a containment strategy appropriate to the incident, the
impacted system and the available resources.
• Gather evidence to allow for further investigation, as the
incident progresses and once it is complete, as well as
potential prosecution.
• Where time and resources permit, identify the attacker to
help stop the incident as well as to prepare for potential
prosecution.
8.1.4.4 Eradicate Contained Threats and Recover to Normal Operations
After threats have been fully contained they must be fully removed
from impacted systems and those systems must be returned to
normal operational status:
• Eradicate all non-evidentiary remnants of incident.
• Recover affected systems and system components to preincident
status and return to normal operations.
• Maintain heightened monitoring of the affected system(s) for
a period of time subsequent to an incident to ensure there are
no lingering impacts.
8.1.4.5 Perform Post-Recovery Tasks
When the threats associated with an incident have been verifiably
removed from the system, follow-up work must be performed:
• Retain evidence according to predetermined standards.
• Collect lessons learned and prepare a formal incident
response report.
19