prioritized as high or critical and IT-SIRT will take necessary actions including but not limited to:

1. Detection and Analysis

Key Functions:

  • Following impact analysis
  • Determining systems impacted
  • Determining the exact type of incident.

2. Communication

Key Functions:

  • Determine appropriate notification requirements.
  • If required, complete determined breach notification form in Appendix C.
  • Develop an action plan for meeting notification requirements.

3. Containment

Key functions:

  • Stop potential loss of data.
  • Prevent further damage or comprised systems and/or information.
  • Protect other Information systems or resources.
  • Identify the location and owner of the device in order to engage in containment, eradication, and recovery.
  • Determine if delayed containment is necessary to collect evidence.
  • Maximize the preservation of evidence.

4. Preservation of Evidence

Key Functions:

  • Make backups (preferably disk image backups, not file system backups) of affected systems.
  • Make copies of log files that contain evidence related to the incident.
  • Preserve evidence not already preserved.
  • Perform additional evidence gathering activities.

5. Eradication

Key Functions:

  • Identify and mitigate all vulnerabilities that were exploited.
  • Remove all traces of the attack or the breach.

6. Remediation

Key functions:

  • Return affected system to an operationally ready state.
  • Ensure system returns to fully operational status.
  • Improve physical security of equipment.

7. Documentation

Key Functions:

  • a. Create and issue final reports.