SFS 6 / SF E

Back to SFS 6

Status: Question model review passed; solution and completed SF authoring pending.

This is a generated authoring draft. Human approval and operational assessment results have not been supplied.

Question

Has documented verification confirmed that incident containment actions for critical systems were completed within defined timeframes for all confirmed security events during the review period, with justified exceptions properly recorded?

Plain-language explanation

Model-reviewed question draft. Completed explanations and a canonical solution are pending. The proposed positive criterion is: Documented evidence shows containment actions completed within policy-defined timeframes for all confirmed security events

Assessment criterion and evidence

Actor: organization's incident response team. Scope: critical systems declared in scope, confirmed security events requiring containment. Evidence period: review period. Required evidence: Incident reports with timestamps of detection and containment completion; Policy documentation specifying maximum allowable containment timeframes. Negative criterion: Documented evidence shows containment actions exceeded policy-defined timeframes without valid justification for any confirmed security event. Missing evidence: Pending assessment due to absence of incident reports or containment documentation

View the JSON record (opens in a new tab).

Assessment result: unset.