IR-4—Incident Handling

Implement an incident handling capability for incidents that is consistent with the incident response plan and includes preparation, detection and analysis, containment, eradication, and recovery;

Coordinate incident handling activities with contingency planning activities;

Incorporate lessons learned from ongoing incident handling activities into incident response procedures, training, and testing, and implement the resulting changes accordingly; and

Ensure the rigor, intensity, scope, and results of incident handling activities are comparable and predictable across the organization.