2.7.2—Incident Response Procedures
>Control Description
FRFIs should implement processes and procedures for managing technology incidents; elements may include:
Defining and documenting roles and responsibilities of relevant internal and external parties to support effective incident response;
Establishing early warning indicators or triggers of system disruption (i.e., detection) that are informed by ongoing threat assessment and risk surveillance activities;
Identifying and classifying incidents according to priority, based on their impacts on business services;
Developing and implementing incident response procedures that mitigate the impacts of incidents, including internal and external communication actions that contain escalation and notification triggers and processes;
Performing periodic testing and exercises using plausible scenarios in order to identify and remedy gaps in incident response actions and capabilities;
Conducting periodic exercises and testing of incident management process, playbooks, and other response tools (e.g., coordination and communication) to validate and maintain their effectiveness; and
Establishing and periodically testing incident management processes with third parties.
>Cross-Framework Mappings
Ask AI
Configure your API key to use AI features.