网络安全 GRC 17 项
Cybersecurity Incident Response Readiness Checklist
此检查清单为英文版。
Assesses incident response capability across preparation, detection, containment, eradication, recovery, and post-incident activity.
NIST 800-61r2ISO 27001:2022SOC 2
免费 PDF 或 Word · 输入邮箱即可下载。
Preparation
- Is a documented incident response plan approved and maintained? *
- Is an incident response team defined with roles and contact information? *
- Are severity classification and escalation criteria defined? *
- Are IR tools, jump kits, and communication channels prepared in advance? *
Detection & Analysis
- Are detection sources (SIEM, EDR, IDS) monitored to identify incidents? *
- Is a process defined to triage and validate alerts as incidents? *
- Are incidents documented with timelines and evidence from the outset? *
Containment, Eradication & Recovery
- Are short-term and long-term containment strategies defined? *
- Are procedures defined to eradicate threats and remediate root cause? *
- Is evidence preserved with proper chain of custody for potential legal action? *
- Are recovery and validation steps defined to restore systems safely? *
Communication & Reporting
- Are internal and external notification requirements (regulators, customers) defined? *
- Are breach notification timelines mapped to applicable regulations? *
- Is a designated spokesperson identified for external communications? *
Post-Incident Activity
- Is a lessons-learned review conducted after major incidents? *
- Are tabletop exercises conducted at least annually? *
- When was the most recent incident response exercise conducted?
下载完整的Cybersecurity Incident Response Readiness Checklist检查清单
免费获取排版清晰、便于打印的 PDF，或可编辑的 Word 文档。