RS — Respond
13 outcomes in the Respond function
RS.MA-01The incident response plan is executed in coordination with relevant third parties once an incident is declared
RS.MA-02Incident reports are triaged and validated
RS.MA-03Incidents are categorized and prioritized
RS.MA-04Incidents are escalated or elevated as needed
RS.MA-05The criteria for initiating incident recovery are applied
RS.AN-03Analysis is performed to establish what has taken place during an incident and the root cause of the incident
RS.AN-06Actions performed during an investigation are recorded, and the records’ integrity and provenance are preserved
RS.AN-07Incident data and metadata are collected, and their integrity and provenance are preserved
RS.AN-08An incident’s magnitude is estimated and validated
RS.CO-02Internal and external stakeholders are notified of incidents
RS.CO-03Information is shared with designated internal and external stakeholders
RS.MI-01Incidents are contained
RS.MI-02Incidents are eradicated