Please enable JavaScript.
Coggle requires JavaScript to display documents.
1 - Conducting Incident Management - Coggle Diagram
1 - Conducting Incident Management
Standards
NIST SP 800-61: Computer Security Incident Handling Guide
Computer security incident = a violation or imminent threat of violation of computer security policies, acceptable use policies, or standard security practices
NIST SP 800-61 steps
Reporting
Inform management, legal, compliance, public relations (PR) (depending on severity).
Report to regulators if mandated (e.g., GDPR, HIPAA, state breach laws).
Notify affected parties if necessary.
Provide updates to stakeholders.
Recovery (temporary fix)
Restore from backups or rebuild systems.
Patch vulnerable components.
Verify system integrity and stability.
Gradually reintroduce systems into production.
Monitor for reinfection or residual threats.
Mitigation
Isolate compromised systems or networks.
Disable breached accounts.
Block malicious IPs or traffic.
Apply temporary rules or configurations.
Remediation (permanent fix)
Confirm root cause (technical or procedural).
Remove vulnerabilities, misconfigurations, or weaknesses.
Strengthen access control, monitoring, segmentation, etc.
Update playbooks and controls based on findings.
Response
Notify the Computer Security Incident Response Team (CSIRT)
Establish communication channels.
Begin evidence collection and chain of custody.
What evidence was collected
Who handled it, at every step
How it was stored, protected, and transferred
That the evidence was not altered, tampered with, or lost
Decide on containment strategy.
Lessons learned
Conduct a post-incident review (hotwash).
Analyze what worked and what did not.
Update incident response procedures.
Train teams based on new insights.
Improve detection, controls, architecture, or processes.
Detection
Monitoring alerts, logs, IDS/IPS, EDR, user reports.
Validating indicators of compromise (IOCs).
Determining incident category and severity.
Starting initial documentation.