IR-10—Integrated Information Security Analysis Team

Having an integrated team for incident response facilitates information sharing. Having such a capability allows organizational personnel, including developers, implementers, and operators, to leverage the team's knowledge of the threat in order to implement defensive measures that will enable organizations to deter intrusions more effectively. Moreover, it promotes the rapid detection of intrusions, development of appropriate mitigations, and deployment of effective defensive measures.

For example, when an intrusion is detected, the integrated security analysis team can rapidly develop an appropriate response for operators to implement, correlate the new incident with information on past intrusions, and augment ongoing intelligence development. This enables the team to identify adversary tactics, techniques, and procedures (TTPs) that are linked to the operations tempo or to specific missions/business functions, and to define responsive actions in a way that does not disrupt the mission/business operations. Ideally, information security analysis teams are distributed within organizations to make the capability more resilient