[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"framework:cis\u002F17":3},{"item":4,"lessons":16,"controls":67,"related":98},{"family":5,"item":6,"code":7,"title":8,"citations":9,"publisher":10,"summary_md":11,"official_text":12,"official_attribution":12,"official_url":13,"link_label":14,"note":12,"updated_at":15},"cis","17","Control 17","Incident Response Management",457,"Center for Internet Security (CIS)","**What it asks for.** This control asks organisations to build and maintain an incident response capability, including policies, plans, procedures, defined roles, training and communications, to prepare for, detect and quickly respond to an attack.\n\n**In practice.** There is a documented plan with named roles and deputies, contact details for internal and external parties such as legal, insurers, regulators and law enforcement, and a clear mechanism for staff to report incidents. Exercises such as tabletop scenarios are held regularly and post incident reviews lead to tracked improvements. Evidence includes the plan, contact lists, exercise reports and lessons learned records.\n\n**Common gaps.** Plans are often written but never exercised, and contact lists go out of date. Regulatory notification duties and decision authority during a crisis are frequently unclear until an incident actually happens.",null,"https:\u002F\u002Fwww.cisecurity.org\u002Fcontrols\u002Fincident-response-management","Read the control at CIS","2026-10-18T15:18:43.663+00:00",{"total":17,"list":18},459,[19,23,27,31,35,39,43,47,51,55,59,63],{"slug":20,"title":21,"published_at":22},"greek-authority-fined-for-unlawful-publication-of-personal-data-on-transparency-portal","Greek Authority Fined for Unlawful Publication of Personal Data on Transparency Portal","2026-10-18T20:20:25.794+00:00",{"slug":24,"title":25,"published_at":26},"siteguard-waf-os-command-injection-exploited-for-root-access","SiteGuard WAF OS Command Injection Exploited for Root Access","2026-10-18T16:20:26.047+00:00",{"slug":28,"title":29,"published_at":30},"compromised-connectwise-credential-exposes-173-microsoft-365-tenants","Compromised ConnectWise Credential Exposes 173 Microsoft 365 Tenants","2026-10-17T08:20:20.122+00:00",{"slug":32,"title":33,"published_at":34},"nist-nsa-cisa-issue-guidance-on-ai-incident-readiness-for-high-risk-ai-systems","NIST, NSA & CISA Issue Guidance on AI Incident Readiness for High-Risk AI Systems","2026-10-16T18:21:54.014+00:00",{"slug":36,"title":37,"published_at":38},"bae-systems-breach-cripples-us-bankruptcy-court-noticing-system","BAE Systems Breach Cripples US Bankruptcy Court Noticing System","2026-10-16T16:20:16.497+00:00",{"slug":40,"title":41,"published_at":42},"romulus-malware-platform-exploits-human-deception-via-clickfix-lures","ROMULUS Malware Platform Exploits Human Deception via ClickFix Lures","2026-10-16T15:20:34.428+00:00",{"slug":44,"title":45,"published_at":46},"ransomware-negotiator-secretly-worked-for-the-attackers","Ransomware Negotiator Secretly Worked for the Attackers","2026-10-16T15:20:17.253+00:00",{"slug":48,"title":49,"published_at":50},"burger-king-japan-app-breach-exposes-11m-member-records","Burger King Japan App Breach Exposes 11M Member Records","2026-10-16T12:21:23.341+00:00",{"slug":52,"title":53,"published_at":54},"bae-systems-contractor-incident-cripples-us-bankruptcy-court-notifications","BAE Systems Contractor Incident Cripples US Bankruptcy Court Notifications","2026-10-16T12:20:16.174+00:00",{"slug":56,"title":57,"published_at":58},"ai-confidence-accuracy-human-oversight-is-non-negotiable-in-forensics","AI Confidence ≠ Accuracy: Human Oversight Is Non-Negotiable in Forensics","2026-10-15T14:21:23.922+00:00",{"slug":60,"title":61,"published_at":62},"billion-message-phishing-infrastructure-dismantled-by-microsoft-and-partners","Billion-Message Phishing Infrastructure Dismantled by Microsoft and Partners","2026-10-15T12:20:54.937+00:00",{"slug":64,"title":65,"published_at":66},"uk-legal-aid-agency-breach-exposes-decades-of-sensitive-records","UK Legal Aid Agency Breach Exposes Decades of Sensitive Records","2026-10-15T10:21:06.955+00:00",[68,73,78,83,88,93],{"slug":69,"name":70,"problem":71,"stories":72},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",137,{"slug":74,"name":75,"problem":76,"stories":77},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",73,{"slug":79,"name":80,"problem":81,"stories":82},"email-security","Email security","Phishing, malware and invoice fraud are filtered out before they reach inboxes.",70,{"slug":84,"name":85,"problem":86,"stories":87},"security-awareness-training","Security awareness training and phishing simulation","People recognise and report attacks instead of falling for them.",66,{"slug":89,"name":90,"problem":91,"stories":92},"phishing-resistant-mfa","Phishing-resistant MFA","A stolen password, or a user who taps Approve on a push prompt, is no longer enough to log in.",64,{"slug":94,"name":95,"problem":96,"stories":97},"incident-response-retainer","Incident response retainer","Experts are on call before the worst day, not searched for during it.",63,[99,104,110,116,121,127,132,138],{"family":100,"item":101,"code":102,"title":102,"together":103},"itil","overview","ITIL",245,{"family":105,"item":106,"code":107,"title":108,"together":109},"gdpr","32","Article 32","Security of processing",202,{"family":111,"item":112,"code":113,"title":114,"together":115},"nist-sp","800-61","SP 800-61","SP 800-61 Rev. 3: Incident Response Recommendations and Considerations for Cybersecurity Risk Management",163,{"family":105,"item":117,"code":118,"title":119,"together":120},"33","Article 33","Notification of a personal data breach to the supervisory authority",146,{"family":122,"item":123,"code":124,"title":125,"together":126},"nist-800-53","ir-4","IR-4","Incident Handling",145,{"family":5,"item":128,"code":129,"title":130,"together":131},"14","Control 14","Security Awareness and Skills Training",130,{"family":133,"item":134,"code":135,"title":136,"together":137},"nist-csf","de-cm","DE.CM-1","Continuous Monitoring",118,{"family":122,"item":139,"code":140,"title":141,"together":142},"ac-2","AC-2","Account Management",112]