Requirement
164.308(a)(6) - Implement policies and procedures to address security incidents.
Implementation Specifications
Response and Reporting (Required) - 164.308(a)(6)(ii)
Requirement: Identify and respond to suspected or known security incidents; mitigate, to the extent practicable, harmful effects of security incidents that are known to the covered entity; and document security incidents and their outcomes.
Explanation
The purpose of this standard is to require covered entities to address security incidents within their environment. Addressing security incidents is an integral part of the overall security program.
