{
    "document_id": 13949,
    "page": 3,
    "width_pt": 612,
    "height_pt": 792,
    "rotation": 0,
    "pipeline_version": "paddleocr-vl-1.6+paul-48",
    "engine": "paddleocr_vl",
    "source_run_id": 14060,
    "item_count": 43,
    "counts_by_type": {
        "heading": 14,
        "list": 6,
        "list_item": 21,
        "text": 2
    },
    "build_ms": 5,
    "items": [
        {
            "id": "p3.1",
            "order": 1,
            "type": "text",
            "bbox": {
                "l": 69.6,
                "t": 755.76,
                "r": 505.2,
                "b": 741.12
            },
            "text": "prioritized as high or critical and IT-SIRT will take necessary actions including but not limited to:"
        },
        {
            "id": "p3.2",
            "order": 2,
            "type": "heading",
            "bbox": {
                "l": 87.84,
                "t": 726.96,
                "r": 212.4,
                "b": 714
            },
            "text": "1. Detection and Analysis",
            "attrs": {
                "block_label": "paragraph_title"
            },
            "level": 3
        },
        {
            "id": "p3.3",
            "order": 3,
            "type": "heading",
            "bbox": {
                "l": 105.12,
                "t": 704.4,
                "r": 175.2,
                "b": 692.16
            },
            "text": "Key Functions:",
            "level": 3
        },
        {
            "id": "p3.4",
            "order": 4,
            "type": "list",
            "bbox": {
                "l": 126.02,
                "t": 689.74,
                "r": 319.02608,
                "b": 649.78
            },
            "text": "",
            "attrs": {
                "item_count": 3
            },
            "children": [
                {
                    "id": "p3.4.1",
                    "order": 5,
                    "type": "list_item",
                    "bbox": {
                        "l": 126.02,
                        "t": 689.74,
                        "r": 257.76512,
                        "b": 678.7
                    },
                    "text": "Following impact analysis",
                    "marker": "a."
                },
                {
                    "id": "p3.4.2",
                    "order": 6,
                    "type": "list_item",
                    "bbox": {
                        "l": 126.02,
                        "t": 675.22,
                        "r": 282.59408,
                        "b": 664.1800000000001
                    },
                    "text": "Determining systems impacted",
                    "marker": "b."
                },
                {
                    "id": "p3.4.3",
                    "order": 7,
                    "type": "list_item",
                    "bbox": {
                        "l": 126.02,
                        "t": 660.8199999999999,
                        "r": 319.02608,
                        "b": 649.78
                    },
                    "text": "Determining the exact type of incident.",
                    "marker": "c."
                }
            ]
        },
        {
            "id": "p3.5",
            "order": 8,
            "type": "heading",
            "bbox": {
                "l": 87.84,
                "t": 632.88,
                "r": 181.44,
                "b": 620.4
            },
            "text": "2. Communication",
            "attrs": {
                "block_label": "paragraph_title"
            },
            "level": 3
        },
        {
            "id": "p3.6",
            "order": 9,
            "type": "heading",
            "bbox": {
                "l": 105.12,
                "t": 610.32,
                "r": 175.44,
                "b": 598.32
            },
            "text": "Key Functions:",
            "level": 3
        },
        {
            "id": "p3.7",
            "order": 10,
            "type": "list",
            "bbox": {
                "l": 126.02,
                "t": 595.9,
                "r": 471.7876,
                "b": 555.8199999999999
            },
            "text": "",
            "attrs": {
                "item_count": 3
            },
            "children": [
                {
                    "id": "p3.7.1",
                    "order": 11,
                    "type": "list_item",
                    "bbox": {
                        "l": 126.02,
                        "t": 595.9,
                        "r": 367.2488,
                        "b": 584.86
                    },
                    "text": "Determine appropriate notification requirements.",
                    "marker": "a."
                },
                {
                    "id": "p3.7.2",
                    "order": 12,
                    "type": "list_item",
                    "bbox": {
                        "l": 126.02,
                        "t": 581.38,
                        "r": 471.7876,
                        "b": 570.34
                    },
                    "text": "If required, complete determined breach notification form in Appendix C.",
                    "marker": "b."
                },
                {
                    "id": "p3.7.3",
                    "order": 13,
                    "type": "list_item",
                    "bbox": {
                        "l": 126.02,
                        "t": 566.86,
                        "r": 421.15712,
                        "b": 555.8199999999999
                    },
                    "text": "Develop an action plan for meeting notification requirements.",
                    "marker": "c."
                }
            ]
        },
        {
            "id": "p3.8",
            "order": 14,
            "type": "heading",
            "bbox": {
                "l": 87.6,
                "t": 538.8,
                "r": 168.96,
                "b": 526.32
            },
            "text": "3. Containment",
            "attrs": {
                "block_label": "paragraph_title"
            },
            "level": 3
        },
        {
            "id": "p3.9",
            "order": 15,
            "type": "heading",
            "bbox": {
                "l": 103.2,
                "t": 517.44,
                "r": 174.24,
                "b": 504
            },
            "text": "Key functions:",
            "level": 3
        },
        {
            "id": "p3.10",
            "order": 16,
            "type": "list",
            "bbox": {
                "l": 122.64,
                "t": 503.04,
                "r": 560.4,
                "b": 403.68
            },
            "text": "",
            "attrs": {
                "item_count": 6
            },
            "children": [
                {
                    "id": "p3.10.1",
                    "order": 17,
                    "type": "list_item",
                    "bbox": {
                        "l": 123.12,
                        "t": 503.04,
                        "r": 265.44,
                        "b": 490.56
                    },
                    "text": "Stop potential loss of data.",
                    "marker": "a."
                },
                {
                    "id": "p3.10.2",
                    "order": 18,
                    "type": "list_item",
                    "bbox": {
                        "l": 122.88,
                        "t": 488.88,
                        "r": 444,
                        "b": 476.16
                    },
                    "text": "Prevent further damage or comprised systems and/or information.",
                    "marker": "b."
                },
                {
                    "id": "p3.10.3",
                    "order": 19,
                    "type": "list_item",
                    "bbox": {
                        "l": 122.64,
                        "t": 474,
                        "r": 360.96,
                        "b": 462.24
                    },
                    "text": "Protect other Information systems or resources.",
                    "marker": "c."
                },
                {
                    "id": "p3.10.4",
                    "order": 20,
                    "type": "list_item",
                    "bbox": {
                        "l": 123.12,
                        "t": 459.36,
                        "r": 560.4,
                        "b": 433.2
                    },
                    "text": "Identify the location and owner of the device in order to engage in containment, eradication, and recovery.",
                    "marker": "d."
                },
                {
                    "id": "p3.10.5",
                    "order": 21,
                    "type": "list_item",
                    "bbox": {
                        "l": 122.64,
                        "t": 430.8,
                        "r": 444.24,
                        "b": 418.56
                    },
                    "text": "Determine if delayed containment is necessary to collect evidence.",
                    "marker": "e."
                },
                {
                    "id": "p3.10.6",
                    "order": 22,
                    "type": "list_item",
                    "bbox": {
                        "l": 122.88,
                        "t": 415.92,
                        "r": 322.8,
                        "b": 403.68
                    },
                    "text": "Maximize the preservation of evidence.",
                    "marker": "f."
                }
            ]
        },
        {
            "id": "p3.11",
            "order": 23,
            "type": "heading",
            "bbox": {
                "l": 87.6,
                "t": 387.36,
                "r": 220.32,
                "b": 374.64
            },
            "text": "4. Preservation of Evidence",
            "attrs": {
                "block_label": "paragraph_title"
            },
            "level": 3
        },
        {
            "id": "p3.12",
            "order": 24,
            "type": "heading",
            "bbox": {
                "l": 105.36,
                "t": 364.8,
                "r": 175.44,
                "b": 352.56
            },
            "text": "Key Functions:",
            "level": 3
        },
        {
            "id": "p3.13",
            "order": 25,
            "type": "list",
            "bbox": {
                "l": 126.02,
                "t": 350.09,
                "r": 554.6804,
                "b": 295.61
            },
            "text": "",
            "attrs": {
                "item_count": 4
            },
            "children": [
                {
                    "id": "p3.13.1",
                    "order": 26,
                    "type": "list_item",
                    "bbox": {
                        "l": 126.02,
                        "t": 350.09,
                        "r": 554.6804,
                        "b": 339.05
                    },
                    "text": "Make backups (preferably disk image backups, not file system backups) of affected systems.",
                    "marker": "a."
                },
                {
                    "id": "p3.13.2",
                    "order": 27,
                    "type": "list_item",
                    "bbox": {
                        "l": 126.02,
                        "t": 335.57,
                        "r": 453.42704,
                        "b": 324.53
                    },
                    "text": "Make copies of log files that contain evidence related to the incident.",
                    "marker": "b."
                },
                {
                    "id": "p3.13.3",
                    "order": 28,
                    "type": "list_item",
                    "bbox": {
                        "l": 126.02,
                        "t": 321.17,
                        "r": 329.26016,
                        "b": 310.13
                    },
                    "text": "Preserve evidence not already preserved.",
                    "marker": "c."
                },
                {
                    "id": "p3.13.4",
                    "order": 29,
                    "type": "list_item",
                    "bbox": {
                        "l": 126.02,
                        "t": 306.65,
                        "r": 360.9008,
                        "b": 295.61
                    },
                    "text": "Perform additional evidence gathering activities.",
                    "marker": "d."
                }
            ]
        },
        {
            "id": "p3.14",
            "order": 30,
            "type": "heading",
            "bbox": {
                "l": 87.84,
                "t": 271.92,
                "r": 161.04,
                "b": 259.2
            },
            "text": "5. Eradication",
            "attrs": {
                "block_label": "paragraph_title"
            },
            "level": 3
        },
        {
            "id": "p3.15",
            "order": 31,
            "type": "heading",
            "bbox": {
                "l": 105.12,
                "t": 249.6,
                "r": 174.96,
                "b": 236.88
            },
            "text": "Key Functions:",
            "level": 3
        },
        {
            "id": "p3.16",
            "order": 32,
            "type": "list",
            "bbox": {
                "l": 126.02,
                "t": 234.76999999999998,
                "r": 408.58256,
                "b": 209.21000000000004
            },
            "text": "",
            "attrs": {
                "item_count": 2
            },
            "children": [
                {
                    "id": "p3.16.1",
                    "order": 33,
                    "type": "list_item",
                    "bbox": {
                        "l": 126.02,
                        "t": 234.76999999999998,
                        "r": 408.58256,
                        "b": 223.73000000000002
                    },
                    "text": "Identify and mitigate all vulnerabilities that were exploited.",
                    "marker": "a."
                },
                {
                    "id": "p3.16.2",
                    "order": 34,
                    "type": "list_item",
                    "bbox": {
                        "l": 126.02,
                        "t": 220.25,
                        "r": 347.73008,
                        "b": 209.21000000000004
                    },
                    "text": "Remove all traces of the attack or the breach.",
                    "marker": "a."
                }
            ]
        },
        {
            "id": "p3.17",
            "order": 35,
            "type": "heading",
            "bbox": {
                "l": 87.84,
                "t": 192.48,
                "r": 167.28,
                "b": 180
            },
            "text": "6. Remediation",
            "attrs": {
                "block_label": "paragraph_title"
            },
            "level": 3
        },
        {
            "id": "p3.18",
            "order": 36,
            "type": "heading",
            "bbox": {
                "l": 105.12,
                "t": 170.16,
                "r": 173.52,
                "b": 157.68
            },
            "text": "Key functions:",
            "level": 3
        },
        {
            "id": "p3.19",
            "order": 37,
            "type": "list",
            "bbox": {
                "l": 126.02,
                "t": 155.41999999999996,
                "r": 390.75296,
                "b": 115.34000000000003
            },
            "text": "",
            "attrs": {
                "item_count": 3
            },
            "children": [
                {
                    "id": "p3.19.1",
                    "order": 38,
                    "type": "list_item",
                    "bbox": {
                        "l": 126.02,
                        "t": 155.41999999999996,
                        "r": 390.75296,
                        "b": 144.38
                    },
                    "text": "Return affected system to an operationally ready state.",
                    "marker": "a."
                },
                {
                    "id": "p3.19.2",
                    "order": 39,
                    "type": "list_item",
                    "bbox": {
                        "l": 126.02,
                        "t": 140.89999999999998,
                        "r": 364.16072,
                        "b": 129.86
                    },
                    "text": "Ensure system returns to fully operational status.",
                    "marker": "b."
                },
                {
                    "id": "p3.19.3",
                    "order": 40,
                    "type": "list_item",
                    "bbox": {
                        "l": 126.02,
                        "t": 126.38,
                        "r": 323.50832,
                        "b": 115.34000000000003
                    },
                    "text": "Improve physical security of equipment.",
                    "marker": "c."
                }
            ]
        },
        {
            "id": "p3.20",
            "order": 41,
            "type": "heading",
            "bbox": {
                "l": 87.6,
                "t": 98.64,
                "r": 179.76,
                "b": 85.92
            },
            "text": "7. Documentation",
            "attrs": {
                "block_label": "paragraph_title"
            },
            "level": 3
        },
        {
            "id": "p3.21",
            "order": 42,
            "type": "heading",
            "bbox": {
                "l": 105.12,
                "t": 76.32,
                "r": 175.44,
                "b": 62.88
            },
            "text": "Key Functions:",
            "level": 3
        },
        {
            "id": "p3.22",
            "order": 43,
            "type": "text",
            "bbox": {
                "l": 123.36,
                "t": 59.04,
                "r": 278.64,
                "b": 45.84
            },
            "text": "a. Create and issue final reports."
        }
    ],
    "excluded_furniture": {
        "first": [],
        "last": []
    }
}