Respond

Question 1

RS.RP-1

Answer 1

Response plan is executed during or after an event

Question 2

RS.CO-1

Answer 2

Personnel know their roles and order of operations when a response is needed

Question 3

RS.CO-2

Answer 3

Events are reported consistent with established criteria

Question 4

RS.CO-3

Answer 4

Information is shared consistent with response plans

Question 5

RS.CO-4

Answer 5

Coordination with stakeholders occurs consistent with response plans

Question 6

RS.CO-5

Answer 6

Voluntary information sharing occurs with external stakeholders to achieve broader cybersecurity situational awareness

Question 7

RS.AN-1

Answer 7

Notifications from detection systems are investigated

Question 8

RS.AN-2

Answer 8

The impact of the incident is understood

Question 9

RS.AN-3

Answer 9

Forensics are performed

Question 10

RS.AN-4

Answer 10

Incidents are categorized consistent with response plans

Question 11

RS.MI-1

Answer 11

Incidents are contained

Question 12

RS.MI-2

Answer 12

Incidents are mitigated

Question 13

RS.MI-3

Answer 13

Newly identified vulnerabilities are mitigated or documented as accepted risks

Question 14

RS.IM-1

Answer 14

Response plans incorporate lessons learned

Question 15

RS.IM-2

Answer 15

Response strategies are updated