The incident response preparation phase in cyber security involves a range of activities and steps to ensure that an organization is prepared to respond to a cyber security incident. Here are some examples of activities that are typically part of the incident response preparation phase:
-
Developing an incident response plan: This involves creating a document that outlines the steps to be taken in the event of a cyber security incident, including roles and responsibilities, communication protocols, and procedures for handling the incident.
-
Identifying critical assets: This involves identifying and prioritizing the systems, data, and resources that are most critical to the organization's operations, and determining how to protect them in the event of an incident.
-
Establishing an incident response team: This involves identifying and training personnel who will be responsible for responding to a cyber security incident, including roles such as incident commander, technical lead, and communications lead.
-
Conducting incident response drills and exercises: This involves practicing and testing the incident response plan and procedures through simulated cyber security incidents.
-
Establishing relationships with external partners: This involves building relationships with outside organizations, such as law enforcement agencies or cybersecurity firms, that may be called upon to assist with a cyber security incident.
The activity that does not belong on this list is:
- Implementing security controls: While implementing security controls is an important part of overall cyber security efforts, it is not typically considered part of the incident response preparation phase. Instead, security controls are implemented as a ongoing part of an organization's overall security posture, and are designed to prevent incidents from occurring in the first place.
