Incident Response (03.07)

The ir family requires organizations to establish and maintain an incident-response capability for controlled unclassified information, including policies, procedures, and roles for detecting, reporting, analyzing, and mitigating security incidents. It mandates timely documentation of incidents, coordination with appropriate stakeholders, and regular testing and training to ensure effective response and recovery actions.