Information Security Incident Management Planning and Preparation
Description
The organisation shall plan and prepare for managing information security incidents.
⚠️ Risk Impact
First-incident execution determines breach cost. Unprepared teams improvise; prepared teams execute. The cost difference is 3-5× in measured organisations.
🔍 How EchelonGraph Detects This
EchelonGraph's Tier 1 Cloud Scanner automatically checks for this condition across all connected cloud accounts. Violations are flagged as high-severity findings with remediation guidance.
🔧 Remediation
Document IR plan with playbooks per incident type (ransomware, BEC, data exfil, account takeover). Tabletop quarterly. Define IR roles + authority. 24/7 on-call rotation.
💀 Real-World Attack Scenario
A retailer was hit by Akira ransomware in 2024. The team had no playbook for ransomware specifically (generic IR plan only). Response improvisation took 8 days before backups were verified + restoration began. Companies with rehearsed playbooks restored in 2-3 days. Cost difference: $3.4M in SLA + customer churn.
💰 Cost of Non-Compliance
Rehearsed-IR cost vs improvised: 58% lower (Ponemon Cyber Resilient Organization 2024). GDPR Article 33 violations (>72h authority notification): up to €10M / 2%.
📋 Audit Questions
- 1.Show ransomware playbook.
- 2.When was last tabletop exercise?
- 3.Who is Incident Commander? Authority documented?
- 4.Show real-incident timeline from last 12 months.
🎯 MITRE ATT&CK Mapping
⚡ Common Pitfalls
- ⛔Single generic IR plan — same playbook for ransomware + BEC + DDoS (one playbook fits poorly all)
- ⛔No tabletop — first execution is during real incident
- ⛔Communications playbook missing — tech response succeeds but external comms damage compounds
📈 Business Value
Rehearsed IR converts incidents from existential to operational. Highest-leverage security investment after MFA.
⏱️ Effort Estimate
40-80 hours playbook authoring + 8 hours quarterly tabletop
EchelonGraph maintains live IR runbooks; integrates with PagerDuty/Slack
🔗 Cross-Framework References
Automate ISO 27001 A.5.24 compliance
EchelonGraph continuously monitors this control across all your cloud accounts.
Start Free →