What it asks for. This category asks that responses to detected cybersecurity incidents are managed. It covers executing the incident response plan with relevant third parties, triaging and validating reports, categorising and prioritising incidents, escalating as needed and applying criteria for starting recovery.
In practice. A mature process has a clear entry point for incident reports, a triage step that confirms whether an event is an incident, and defined severity categories that drive escalation and resourcing. Incident commanders coordinate internal teams, suppliers and service providers according to agreed roles. Criteria for moving from response to recovery are documented. Evidence includes the incident response plan, a ticketing or case management system with timelines, escalation records, supplier contacts and post-incident reviews.
Common gaps. Gaps typically include inconsistent severity ratings, slow escalation to decision makers and unclear handoffs with managed service providers. Many organisations also lack defined criteria for when to begin recovery.