Requirement
Requirements for cybersecurity incidents and threat management must be defined, documented and approved.
Control Implementation Guidelines
- Develop and document cybersecurity policy for Cybersecurity Incident and Threat management in the organization, including the following:
- Define a cybersecurity incident response plan
- Classify cybersecurity incidents by severity
- Define the roles and responsibilities for cybersecurity incident response and how to communicate with all stakeholders
- Define a mechanism for notifying the National Cybersecurity Authority in the event of a cybersecurity incident
- Share incidents notifications, threat intelligence, intrusion indicators and reports with NCA
- Collect and handle threat intelligence feeds
- Periodically review of cybersecurity incident response plan
- Support the organization's policy by the Executive Management. This must be done through the approval of the organization head or his/her deputy
Relevant Cybersecurity Tools
- Cybersecurity Incident and Threat Management Policy Template
Expected Deliverables
- Cybersecurity policy that covers the requirements of Cybersecurity Incident and Threat management requirements in the organization (e.g., electronic copy or official hard copy)
- Formal approval by the head of the organization or his/her deputy on such document (e.g., via the organization's official e-mail, paper or electronic signature)
