prioritized as high or critical and IT-SIRT will take necessary actions including but not limited to:
Key Functions:
Following impact analysis
Determining systems impacted
Determining the exact type of incident.
Key Functions:
Determine appropriate notification requirements.
If required, complete determined breach notification form in Appendix C.
Develop an action plan for meeting notification requirements.
Key functions:
Stop potential loss of data.
Prevent further damage or comprised systems and/or information.
Protect other Information systems or resources.
Identify the location and owner of the device in order to engage in containment, eradication, and recovery.
Determine if delayed containment is necessary to collect evidence.
Maximize the preservation of evidence.
Key Functions:
Make backups (preferably disk image backups, not file system backups) of affected systems.
Make copies of log files that contain evidence related to the incident.
Preserve evidence not already preserved.
Perform additional evidence gathering activities.
Key Functions:
Identify and mitigate all vulnerabilities that were exploited.
Remove all traces of the attack or the breach.
Key functions:
Return affected system to an operationally ready state.
Ensure system returns to fully operational status.
Improve physical security of equipment.
Key Functions:
a. Create and issue final reports.