SFS 6 / SF 7

Back to SFS 6

Status: Question model review passed; solution and completed SF authoring pending.

This is a generated authoring draft. Human approval and operational assessment results have not been supplied.

Question

Has the organization conducted documented post-incident reviews and updated incident response procedures based on findings after significant security events during the review period?

Plain-language explanation

Model-reviewed question draft. Completed explanations and a canonical solution are pending. The proposed positive criterion is: Documented post-incident reviews exist with corresponding procedure updates

Assessment criterion and evidence

Actor: The organization. Scope: Incident response procedures for significant security events. Evidence period: During the review period. Required evidence: Records of post-incident review meetings; Updated incident response plan versions with change logs referencing review findings. Negative criterion: No reviews conducted or updates implemented based on findings. Missing evidence: Pending until documentation of reviews and updates is provided

View the JSON record (opens in a new tab).

Assessment result: unset.