SFS 6 / SF 8

Back to SFS 6

Status: Question model review passed; solution and completed SF authoring pending.

This is a generated authoring draft. Human approval and operational assessment results have not been supplied.

Question

Does documented evidence confirm that detected security incidents were resolved according to incident response procedures during the review period?

Plain-language explanation

Model-reviewed question draft. Completed explanations and a canonical solution are pending. The proposed positive criterion is: Documented resolution evidence shows verification of containment and eradication steps per procedures

Assessment criterion and evidence

Actor: Organization. Scope: Security incidents requiring documented resolution. Evidence period: Review period. Required evidence: Incident resolution reports matching response procedures; Evidence of verified containment and eradication steps. Negative criterion: Resolution evidence missing or shows incomplete verification of incident handling steps. Missing evidence: Pending verification until resolution documentation is provided

View the JSON record (opens in a new tab).

Assessment result: unset.