SFS 6 / SF 0

Back to SFS 6

Status: Question model review passed; solution and completed SF authoring pending.

This is a generated authoring draft. Human approval and operational assessment results have not been supplied.

Question

Has the organization documented and tested incident response procedures for security events during the review period, including evidence of successful detection, analysis, containment, and eradication steps?

Plain-language explanation

Model-reviewed question draft. Completed explanations and a canonical solution are pending. The proposed positive criterion is: Documented procedures exist and were successfully tested with evidence covering detection through eradication

Assessment criterion and evidence

Actor: Organization. Scope: security events. Evidence period: review period. Required evidence: Documented incident response procedures specifying required steps; Test evidence demonstrating successful execution of all required steps. Negative criterion: Procedures undocumented, untested, or lacking evidence for any required step. Missing evidence: Pending verification when documentation or test evidence is unavailable

View the JSON record (opens in a new tab).

Assessment result: unset.