[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"framework:nist-csf\u002Frs-rp":3},{"item":4,"lessons":16,"controls":66,"related":97},{"family":5,"item":6,"code":7,"title":8,"citations":9,"publisher":10,"summary_md":11,"official_text":12,"official_attribution":12,"official_url":13,"link_label":14,"note":12,"updated_at":15},"nist-csf","rs-rp","RS.RP-1","Response Planning (CSF 1.1)",111,"US National Institute of Standards and Technology (NIST)","**What it asks for.** In CSF 1.1 this Respond category required response processes and procedures to be executed and maintained so that detected incidents receive a timely response. RS.RP-1 asked that the response plan is executed during or after an incident. CSF 2.0 folded this into RS.MA, Incident Management.\n\n**In practice.** An incident response plan with playbooks for common scenarios is triggered by defined criteria, and roles, escalation paths and decision rights are clear. The plan is exercised regularly and updated after incidents and tests. Evidence includes the plan, playbooks, incident tickets showing the plan in use and exercise reports.\n\n**Common gaps.** Plans are frequently not consulted during real incidents because they are too long or out of date. Playbooks may not cover cloud, identity or supplier compromise.",null,"https:\u002F\u002Fwww.nist.gov\u002Fcyberframework","Open the Cybersecurity Framework at NIST","2026-10-18T15:18:43.663+00:00",{"total":9,"list":17},[18,22,26,30,34,38,42,46,50,54,58,62],{"slug":19,"title":20,"published_at":21},"end-of-life-ot-devices-enable-supermarket-refrigeration-cyberattack","End-of-Life OT Devices Enable Supermarket Refrigeration Cyberattack","2026-10-15T14:20:22.449+00:00",{"slug":23,"title":24,"published_at":25},"ivanti-zero-day-grants-root-access-to-fully-patched-vpn-appliances","Ivanti Zero-Day Grants Root Access to Fully Patched VPN Appliances","2026-10-13T20:21:02.111+00:00",{"slug":27,"title":28,"published_at":29},"ai-accelerated-attacks-outpace-traditional-defenses","AI-Accelerated Attacks Outpace Traditional Defenses","2026-10-13T12:21:32.737+00:00",{"slug":31,"title":32,"published_at":33},"ahold-delhaize-disconnects-systems-after-repeat-cyberattack","Ahold Delhaize Disconnects Systems After Repeat Cyberattack","2026-10-13T10:20:19.073+00:00",{"slug":35,"title":36,"published_at":37},"qilin-ransomware-core-member-arrested-after-international-extradition","Qilin Ransomware Core Member Arrested After International Extradition","2026-10-09T16:20:38.53+00:00",{"slug":39,"title":40,"published_at":41},"global-cyber-attacks-surge-48-driven-by-ransomware-phishing-and-ai-enabled-exposure","Global Cyber Attacks Surge 48% Driven by Ransomware, Phishing, and AI-Enabled Exposure","2026-10-08T14:20:25.629+00:00",{"slug":43,"title":44,"published_at":45},"qilin-ransomware-operator-arrested-lessons-from-a-global-extortion-campaign","Qilin Ransomware Operator Arrested: Lessons from a Global Extortion Campaign","2026-10-07T14:20:38.216+00:00",{"slug":47,"title":48,"published_at":49},"shinyhunters-member-detained-cooperating-with-fbi-after-alleged-breach","ShinyHunters Member Detained, Cooperating with FBI After Alleged Breach","2026-10-03T20:20:20.063+00:00",{"slug":51,"title":52,"published_at":53},"teen-alleged-to-lead-killsec-ransomware-gang-behind-500-victims","Teen Alleged to Lead KillSec Ransomware Gang Behind 500 Victims","2026-10-01T22:20:19.419+00:00",{"slug":55,"title":56,"published_at":57},"killsec-ransomware-gang-dismantled-teen-suspected-as-admin","KillSec Ransomware Gang Dismantled, Teen Suspected as Admin","2026-10-01T20:20:18.421+00:00",{"slug":59,"title":60,"published_at":61},"kiteworks-proactive-shutdown-averts-critical-zero-day-exploitation","Kiteworks Proactive Shutdown Averts Critical Zero-Day Exploitation","2026-09-29T16:22:53.803+00:00",{"slug":63,"title":64,"published_at":65},"election-infrastructure-patching-delays-leave-voting-systems-exposed","Election Infrastructure Patching Delays Leave Voting Systems Exposed","2026-09-25T14:20:42.716+00:00",[67,72,77,82,87,92],{"slug":68,"name":69,"problem":70,"stories":71},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",41,{"slug":73,"name":74,"problem":75,"stories":76},"immutable-backup","Immutable backup and recovery","Ransomware cannot delete or encrypt your way back.",26,{"slug":78,"name":79,"problem":80,"stories":81},"incident-response-retainer","Incident response retainer","Experts are on call before the worst day, not searched for during it.",23,{"slug":83,"name":84,"problem":85,"stories":86},"threat-intelligence","Threat intelligence","Attack campaigns reach your sector, suppliers or software before your team hears about them.",20,{"slug":88,"name":89,"problem":90,"stories":91},"patch-management","Automated patch management","Known holes get closed in days, not months.",19,{"slug":93,"name":94,"problem":95,"stories":96},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",17,[98,103,109,114,120,125,131,136],{"family":99,"item":100,"code":101,"title":101,"together":102},"itil","overview","ITIL",66,{"family":104,"item":105,"code":106,"title":107,"together":108},"cis","13","Control 13","Network Monitoring and Defense",65,{"family":104,"item":110,"code":111,"title":112,"together":113},"17","Control 17","Incident Response Management",58,{"family":115,"item":116,"code":117,"title":118,"together":119},"gdpr","32","Article 32","Security of processing",45,{"family":5,"item":121,"code":122,"title":123,"together":124},"de-cm","DE.CM-1","Continuous Monitoring",40,{"family":126,"item":127,"code":128,"title":129,"together":130},"nist-sp","800-61","SP 800-61","SP 800-61 Rev. 3: Incident Response Recommendations and Considerations for Cybersecurity Risk Management",39,{"family":104,"item":132,"code":133,"title":134,"together":135},"12","Control 12","Network Infrastructure Management",37,{"family":104,"item":137,"code":138,"title":139,"together":140},"7","Control 7","Continuous Vulnerability Management",36]