Incident response check list

1. Preparedness and roles

Incident response plan is written and achievableEven when network and internal documents are not available. A valid copy is printed or stored separately.Category: organisational.Risk: During an incident, the action is re-established.Verification: Find the plan without using the organisation's network.Proof: Plan with version and date.NIS2: 21 (2) (b).
There is a designated person who directs the responseIts mandate, responsibility and substitute are laid down in writing.Category: organisational.Risk: Decisions are delayed because there is no one who takes them.Verification: Name the responsible and alternate.Proof: Order.NIS2: 21 (2) (b).
Team roles are divided according to specific responsibilities, not by departmentsWho investigates technically, who communicates, who gives legal support and who makes a decision.Category: staff.Risk: Work duplicates or remains undoed.Verification: Name a person for each task.Proof: The catch list.NIS2: 21 (2) (b).
Anyone may disconnect the system from the network without further coordinationIf each isolation step requires management approval, the attacker works faster than the process.Category: organisational.Risk: The attacker continues his work while waiting for confirmation.Verification: Ask the dancer what he can do alone.Proof: Description of the mandate.NIS2: 21 (2) (b).
The contact list is current and available outside target systemsInternal, suppliers, supervisory authorities and law enforcement.Category: organisational.Risk: The right person cannot be achieved.Verification: Call two random numbers.Proof: List of contacts with date of inspection.NIS2: 21 (2) (b).
Access to external aid is arranged in advanceInvestigation service, legal support and communications. Contracting during an incident is slow and expensive.Category: organisational.Risk: The investigation shall begin days later.Verification: Check the validity of the contract and the response time.Proof: Contract or agreement.NIS2: 21 (2) (b).
It is known whether cyber risk insurance exists and what it requiresSome policies require notification within a specified time frame and not change the systems before the survey.Category: organisational.Risk: Incorrect action loses insurance coverage.Verification: Read the policy notification conditions.Proof: Policy and summary of conditions.NIS2: 21 (2) (b).
Possible scenarios are sorted by impactData leak, data encryption with compression, service interruption and supplier incident require different steps.Category: organisational.Risk: All incidents are handled in the same way.Verification: Find the first steps for each main scenario.Proof: List of scenarios with impacts.NIS2: 21 (2) (b).

2. Disclosure and application

System and network events are monitored continuouslyAnd it is known who responds to the warning outside working hours.Category: technological.Risk: The attacker works unnoticed at night and on weekends.Verification: Check the response to the last alarm on weekends.Proof: Monitoring schedule and alarm log.NIS2: 21 (2) (b).
An incident is reported by one known channelTwo channels mean that some applications do not reach the responsible.Category: organisational.Risk: The application disappears between channels.Verification: Apply the test event and measure response.Proof: Channel description and test record.NIS2: 21 (2) (b).
Employees know how and how quickly to report a suspicious eventChecked with the question of the employee, not with the assumption that the instruction has been read.Category: staff.Risk: The staff member shall notice, but shall not report.Verification: Ask three employees.Proof: Training records.NIS2: 21 (2) (b).
External rapporteur can reach the organisationPublished address for vulnerability and incident reporting, with a deadline for response.Category: organisational.Risk: An external report does not reach the responsible.Verification: Send the test report to the published address.Proof: Published contact and answer.NIS2: 21 (2) (b).
Logs cover systems where the incident is likely to startAccess, authentication, network boundary and administrator activities.Category: technological.Risk: The beginning of the incident is not visible.Verification: Compare log sources with critical systems.Proof: Log Sources List.NIS2: 21 (2) (b).
The time of all systems is synchronized to one sourceWithout this, the sequence of events between the two servers cannot be demonstrated.Category: technological.Risk: The sequence of events cannot be demonstrated.Verification: Compare time in three systems.Proof: Time Synchronization Configuration.NIS2: 21 (2) (b).
False alarms are reduced, not ignoredA warning that no one opens is the same as a warning.Category: technological.Risk: A real anxiety disorder disappears.Verification: Check the number of unprocessed containers.Proof: Alarm statistics.NIS2: 21 (2) (b).

3. Evaluation and classification

Incidents have a scale of gravity with clear thresholdsThe scale determines the rate of reaction, so it is needed before, not during, an incident.Category: organisational.Risk: The rate of reaction is determined by mood, not effect.Verification: Classification of the last incident by scale.Proof: Confirmed scale of gravity.NIS2: 21 (2) (b).
It is known when an incident becomes significantPublic health or safety at risk, loss of at least EUR 500 000 or 5% of turnover, damage to life or health, impact on information on conditional access, significant disruption of service or cross-border impact.Category: organisational.Risk: The reporting obligation is not recognised.Verification: Compare the thresholds with the last incident.Proof: Criteria of importance.NIS2: article 23.
The incident is recorded in the log within 24 hours of detectionThe time limit shall be counted from the moment the incident is detected.Category: organisational.Risk: The incident time line is not restored.Verification: Compare the time of detection and recording.Proof: The magazine record with time.NIS2: 21 (2) (b).
The record shall contain the time of detection, type, description, causes, effects and statusIt also notes whether the incident is significant.Category: organisational.Risk: The report lacks data.Verification: Check that the last record contains all fields.Proof: Incident record.NIS2: 21 (2) (b).
Escalation path to control is defined by time limitManagement learns from the process, not from the news portal.Category: organisational.Risk: Management learns too late.Verification: Check when the management found out about the last incident.Proof: Escalation procedure and record.NIS2: 21 (2) (b).
Assessment of whether personal data are affectedThe assessment starts immediately because it has a separate addressee and a separate deadline.Category: organisational.Risk: Missed notification of personal data.Verification: Check that the assessment is in the record.Proof: Record of the assessment.NIS2: 21 (2) (b).
The decision on classification is recorded with time and the acquirerIt shall subsequently be verified whether the decision was based on the information available at that time.Category: organisational.Risk: The decision may not be substantiated at a later date.Verification: Check the time of the decision and the record of the contributors.Proof: Decision log.NIS2: 21 (2) (b).

4. Restrictions

Affected system is disconnected from network instead of offExclusion destroys the RAM, which is often the only place where what has happened is still visible.Category: technological.Risk: Exclusion destroys traces of memory.Verification: Ask the technical officer for a sequence.Proof: Restriction instruction.NIS2: 21 (2) (b).
Affected passwords and keys are changedAlso those that are shared with other systems.Category: technological.Risk: The attacker returns with the same password.Verification: Check the list of replaced passwords and keys.Proof: Replacement entries.NIS2: 21 (2) (i).
Active sessions and mandates are withdrawnA change of password shall not terminate a session or access authorisation already issued.Category: technological.Risk: An open session allows work to continue.Verification: Check active sessions after withdrawal.Proof: Session Revocation Record.NIS2: 21 (2) (i).
Known entry routes are blocked at network borderAnd the lock is written down to cancel it later.Category: technological.Risk: The attacker returns along the same path.Verification: Check the lock list.Proof: Lock records with time.NIS2: 21 (2) (b).
Checking for adjacent systemsOne compromised equipment is rarely the only one.Category: technological.Risk: Composting continues in another machine.Verification: Check connections from affected system.Proof: List of systems tested.NIS2: 21 (2) (b).
The change made during each incident is recorded in timeWithout it, after three days no one knows what was changed and what can be returned.Category: organisational.Risk: You can't know what can be returned.Verification: Check that each change has time and provider.Proof: Change log.NIS2: 21 (2) (b).
It is decided whether the attacker block immediately or observeSurveillance provides information but extends access. This choice is made consciously, not by chance.Category: organisational.Risk: The attacker stays longer than decided.Verification: Check the entry and justification of the decision.Proof: Record of decision.NIS2: 21 (2) (b).

5. Evidence and investigation

Drive and memory image created before cleaningCleaning is irreversible, creating an image - not.Category: technological.Risk: The evidence disappears during cleaning.Verification: Check that the images are before the cleaning time.Proof: List of images with control numbers.NIS2: 21 (2) (b).
Logs are saved outside the affected systemAn attacker in the system can delete them.Category: technological.Risk: The attacker erases his foot.Verification: Check where the magazines are.Proof: Central Log Storage.NIS2: 21 (2) (b).
The evidence chain is documentedWho took it, when, where it stored it and what access it had.Category: organisational.Risk: Evidence shall not be relied on by a court.Verification: Check chain records for one proof.Proof: The shape of the storage chain.NIS2: 21 (2) (b).
The investigation shall take place with a copy, not with the originalThe original also remains untouched in the case of legal proceedings.Category: technological.Risk: The original is damaged.Verification: Check the copy with which you worked.Proof: Records of investigations.NIS2: 21 (2) (b).
Searching for initial entry path, not only consequencesAvoided consequences without a avoided cause is a repeated incident.Category: technological.Risk: The incident is repeated along the same path.Verification: Check that there is an entry path in the report.Proof: Investigation report.NIS2: 21 (2) (b).
What data and systems are affectedWithout scope, it is neither possible to report accurately nor to inform affected people.Category: technological.Risk: The report and the information are inaccurate.Verification: Check the list of affected data and systems.Proof: Volume assessment.NIS2: 21 (2) (b).
Logs are kept long enough for an incident to be investigatedEntry is often detected months after it occurred.Category: technological.Risk: You can't keep track of a long time.Verification: Check the date of the oldest available record.Proof: Storage settings.NIS2: 21 (2) (b).

6. Eradication and restoration

The cause is eliminated before the system returns to workOtherwise, the renewed system is compromised along the same path.Category: technological.Risk: The renewed system is compromised again.Verification: Check correction before return.Proof: Correction entry.NIS2: 21 (2) (b).
Renewal takes place from a copy known to be cleanA copy created after entry may contain the same access.Category: technological.Risk: Renewal returns the attacker's access.Verification: Compare the date of the copy with the time of entry.Proof: Reasons for selecting a copy.NIS2: 21(2)(c).
Update of backup has been verified in advanceA copy that has not been updated is not a copy.Category: technological.Risk: The copy should not be used when it is needed.Verification: Check the last renewal test.Proof: The renewal protocol.NIS2: 21(2)(c).
Backup not achievable from daily working environmentThe data encryption attack first looks for exactly those.Category: technological.Risk: The spy virus also destroys copies.Verification: Check that copies can be deleted from the working environment.Proof: Storage configuration.NIS2: 21(2)(c).
The renewal sequence is defined by the importance of the serviceOtherwise, it is easier to restore things, not what is needed.Category: organisational.Risk: The most important service returns last.Verification: Compare order with importance of services.Proof: Recovery sequence.NIS2: 21(2)(c).
The system is tested before returning to workBoth the action and the fact that the attacker has no access anymore.Category: technological.Risk: The system returns with attacker access.Verification: Check the result of the check before return.Proof: Check record.NIS2: 21(2)(c).
Post-return monitoring is reinforced for a limited period of timeThe attacker often tries to return along the same path.Category: technological.Risk: A repeat attempt goes unnoticed.Verification: Check the follow-up rules after the incident.Proof: Surveillance records.NIS2: 21 (2) (b).

7. Reporting and communication

Early warning for a significant incident is sent within 24 hoursThe addressee is the competent cyber incident prevention body and the form is signed with a secure electronic signature.Category: organisational.Risk: Delayed warning means sanctions.Verification: Compare the time of detection and transmission.Proof: The sent warning.NIS2: article 23.
Initial report is submitted within 72 hoursIt is another report and another form, not an early warning repeat.Category: organisational.Risk: Delayed report means sanctions.Verification: Check the submission time.Proof: Report submitted.NIS2: article 23.
The final report shall be submitted within one month of the initial reportIf the incident is not resolved so quickly, a progress report and a final report after resolution shall be submitted first.Category: organisational.Risk: The incident shall remain in the eyes of the institution.Verification: Check the date of submission.Proof: Final report or progress report.NIS2: article 23.
A minor incident is reported free of chargeThe threshold has not been reached, but the reporting obligation remains.Category: organisational.Risk: The reporting obligation is forgotten.Verification: Check the last minor incident.Proof: Message sent.NIS2: article 23.
If personal data are affected, the Data State Inspectorate is informed within 72 hoursSeparate addressee and separate obligation, not same message.Category: organisational.Risk: Missed notification of personal data.Verification: Check the time of notification.Proof: Copy of the notification.NIS2: 21 (2) (b).
Affected people and customers are informed when the incident affects themBy what they can do themselves, not only by the fact that something happened.Category: organisational.Risk: The affected cannot protect themselves in good time.Verification: Check the content and timing of the notification.Proof: Notification sent.NIS2: article 23.
Communication during an incident takes place through a channel outside the affected environmentIf an attacker reads an email, the plan is discussed in his presence.Category: technological.Risk: The attacker reads the response plan.Verification: Check that the backup channel is running.Proof: Description and verification of the channel.NIS2: 21 (2) (j).
One speaker has been prepared for public communicationA draft notice saves hours just when it is missing.Category: staff.Risk: Conflicting statements harm trust.Verification: Check the draftsman of the speakers and the statement.Proof: Draft.NIS2: 21 (2) (b).

8. Post-incident training

After the incident, consultation takes place within a specified deadlineWhile details are still remembered, not during quarterly reporting.Category: organisational.Risk: Learning is forgotten.Verification: Compare the date of the incident and consultation.Proof: Minutes of discussions.NIS2: 21 (2) (b).
The incident is added to the outcome and cost registerThe cost is the argument that confirms the next improvement.Category: organisational.Risk: There is no argument for improvement.Verification: Check the record with the cost.Proof: Record recording.NIS2: 21 (2) (b).
The plan is corrected where it failedUnchanged plan after the incident means that there was no training.Category: organisational.Risk: The same error recurs.Verification: Compare the plan version before and after the incident.Proof: History of Plan Change.NIS2: 21 (2) (b).
Specific changes in controls with responsible and time-limit resulting from an incidentDiscussion without assignment is a conversation.Category: organisational.Risk: Conclusions remain on paper.Verification: Check the performance of tasks.Proof: List of tasks with status.NIS2: 21 (2) (b).
Response is trained on a fictional scenario at least once a yearThe first time must not coincide with a real incident.Category: staff.Risk: Teams act for the first time during a real incident.Verification: Check the last date of training.Proof: Training protocol.NIS2: 21 (2) (g).
Contact list and access checked after each trainingAn outdated number appears just when you call it.Category: organisational.Risk: Obsolete contact is revealed during an incident.Verification: Check the date of the contact list.Proof: Check record.NIS2: 21 (2) (b).
Time from discovery to containment is measuredA number that does not change shows that training does not change anything.Category: organisational.Risk: It is not known whether the response is improving.Verification: Compare time in recent incidents and exercises.Proof: Indicator report.NIS2: 21 (2) (f).