← CIS Controls v8 in plain English

17.4 IG2

Control 17 / Incident Response Management

Establish and Maintain an Incident Response Process

Think of it likeCreating a step-by-step plan for how to respond if there’s a break-in at your house.

In plain English

Before anything goes wrong, the household writes the exact sequence to follow during an incident: who to notify, what to disconnect, how to preserve evidence, and how to get back to normal.

Related CSF subcategories (unofficial mapping)

GV.PO-01: Policy for managing cybersecurity risks is established based on organizational context, cybersecurity strategy, and priorities and is communicated and enforced.GV.PO-02: Policy for managing cybersecurity risks is reviewed, updated, communicated, and enforced to reflect changes in requirements, threats, technology, and organizational mission.ID.IM-04: Incident response plans and other cybersecurity plans that affect operations are established, communicated, maintained, and improved.RC.RP-01: The recovery portion of the incident response plan is executed once initiated from the incident response process.RS.MA-01: The incident response plan is executed in coordination with relevant third parties once an incident is declared.RS.MA-03: Incidents are categorized and prioritized.RS.MA-04: Incidents are escalated or elevated as needed.RS.MA-05: The criteria for initiating incident recovery are applied.RS.MI-01: Incidents are contained.RS.MI-02: Incidents are eradicated.