Was the response appropriate?
What lessons have been learned from the incident?
Should any Security Policies be updated?
Additional Comments:
Appendix B: Incident Handling Checklist
ActionCompleted
Detection and Analysis
1Determine whether an incident has occurred
1.1Review Impact Categories
1.2Determine if Restricted or Confidential Info was breached
1.3Determine Systems Impacted
Communication
2Determine appropriate notification requirements.
3Develop an action plan for meeting notification requirements
Containment, Eradication, Preservation of Evidence
4Acquire, preserve, secure and document evidence
5Contain the incident
5.1Stop potential loss of data
5.2Prevent further damage of compromised system and/or info
6Eradicate the incident
6.1Identify and mitigate all vulnerabilities that were exploited
6.2Remove all traces of the attack (Malware, inappropriate materials and/or other components)
Remediate the Incident
7Return affected system to an operationally ready state
8Confirm that the affected systems are functioning normally
Documentation
9Create and issue final reports.
10Archive evidence and documentation.
Post-Incident Activities
11Determine lessons learned.
12Make recommendations to prevent subsequent similar incidents.
13Close out the incident.