What it asks for. This control expects information security incidents to be responded to in accordance with documented procedures. It is the response part of the incident management controls, following planning, assessment and decisions about events. Its purpose is to make the response to incidents efficient and effective.
In practice. Good practice means procedures that cover containment, collecting evidence, escalation, communication with internal and external parties, recovery and closure. Responders know their roles and follow agreed steps, with legal and regulatory notification considered. Auditors expect documented procedures, incident records showing they were followed and post-incident reviews.
Common gaps. Typical gaps are procedures that exist but are bypassed under pressure, poor documentation during incidents and no follow-up on lessons learned. Communication with customers, authorities and suppliers is often improvised rather than prepared, and coordination with external responders is not agreed in advance.