What it asks for. This control expects the organisation to plan and prepare for managing information security incidents by defining, establishing and communicating incident management processes, roles and responsibilities. Its purpose is to make the response to incidents quick, effective, consistent and orderly, including communication about events.
In practice. Good practice means a documented incident management process covering reporting, assessment, response and learning, with named roles, escalation routes and contact lists including external parties. Training and exercises prepare responders, and regulatory notification duties such as those under NIS2 or DORA are built in. Auditors expect the plan, role assignments, exercise records and evidence that the process is communicated.
Common gaps. Typical gaps are plans that do not include regulatory reporting deadlines, untested procedures and no arrangements with external responders before they are needed.