On this page (8)
Why this topic matters
No organization prevents every attack, so detection and response matter as much as prevention. Information Systems and Controls (ISC) Area II tests security monitoring, the phases of incident response, evidence handling, breach notification obligations, and lessons learned.
Events versus incidents
- An event is any observable occurrence (a login, a blocked connection).
- An incident is an event that actually or potentially jeopardizes the confidentiality, integrity, or availability of systems or data, or violates security policy.
- A breach is an incident involving unauthorized access to or disclosure of protected data — often triggering legal notification duties.
Security monitoring
- Logging: capture security-relevant events (authentication, privileged actions, changes, network traffic), protect logs from tampering, and retain them.
- Security information and event management (SIEM) systems collect and correlate logs from many sources and raise alerts. Security orchestration, automation, and response tools automate routine responses.
- A security operations center — an in-house or outsourced team — monitors alerts around the clock.
- Intrusion detection and prevention systems, endpoint detection and response tools, and data loss prevention tools detect suspicious activity and data exfiltration.
- Threat intelligence provides indicators of compromise (known malicious addresses, file hashes) and attacker techniques (for example, the MITRE ATT&CK knowledge base).
- Useful metrics: mean time to detect and mean time to respond or recover.
The incident response life cycle
The National Institute of Standards and Technology (NIST) guidance (Special Publication 800-61) describes these phases, now aligned with the Respond and Recover functions of the NIST Cybersecurity Framework 2.0:
| Phase | Activities |
|---|---|
| 1. Preparation | An incident response plan and playbooks; a defined team with roles (technical, legal, communications, executive); contact lists (law enforcement, insurers, forensic firms, regulators); tools; training and tabletop exercises; cyber insurance |
| 2. Detection and analysis | Identify and validate the incident from alerts or reports; determine scope, affected systems and data, and severity; document everything; prioritize by business impact |
| 3. Containment | Short-term (isolate infected devices, disable compromised accounts, block malicious addresses) and long-term (patch, rebuild temporary systems) — preserving evidence |
| 4. Eradication | Remove malware and attacker access, close the vulnerability, reset credentials |
| 5. Recovery | Restore systems from clean backups, validate they work, monitor closely for reinfection, return to normal operations |
| 6. Post-incident activity | A lessons-learned review: root cause, what worked, what didn't; update controls, plans, and training; retain evidence and documentation |
EXAMPLE (ransomware): An employee opens a phishing attachment and file servers are encrypted. The team isolates affected servers from the network (containment), engages forensic specialists and counsel, identifies the malware and entry point, removes it and resets credentials (eradication), restores data from offline, immutable backups (recovery), evaluates notification duties, and then strengthens email filtering and multi-factor authentication (lessons learned). Paying a ransom is a business and legal decision — it doesn't guarantee recovery and may breach sanctions rules.
Evidence handling
- Preserve volatile evidence (memory, active connections) before shutting systems down where possible.
- Create forensic images rather than working on original media; use hash values to prove images are unaltered.
- Maintain a documented chain of custody — who handled evidence, when, and how — so it is admissible in legal proceedings.
Notification and disclosure
| Requirement | Timing |
|---|---|
| Securities and Exchange Commission (SEC) Form 8-K, Item 1.05 (public companies) | Within 4 business days after determining a cybersecurity incident is material |
| General Data Protection Regulation (GDPR) | Notify the supervisory authority within 72 hours of becoming aware of a personal data breach; notify individuals without undue delay if high risk |
| Health Insurance Portability and Accountability Act (HIPAA) | Notify affected individuals without unreasonable delay and within 60 days of discovery |
| Gramm-Leach-Bliley Act Safeguards Rule | Notify the Federal Trade Commission within 30 days of discovering an event affecting 500 or more customers |
| State breach notification laws | Varying deadlines (often 30–60 days) for affected residents and sometimes the attorney general |
| Contracts | Customer and partner agreements often require prompt notice |
Public companies must also disclose cybersecurity risk management, strategy, and governance in their annual report (Form 10-K Item 1C).
Connecting to controls and assurance
- Incident response plans, monitoring, and testing are evaluated in System and Organization Controls (SOC) 2 engagements under the security criteria (system operations).
- Incidents can reveal control deficiencies that affect internal control over financial reporting — for example, unauthorized changes to financial data.
- Auditors consider the effect of cyber incidents on financial statements: contingent liabilities, impairment, and disclosures.
How it is tested
- Order the phases of incident response and match activities to phases.
- Distinguish events, incidents, and breaches.
- Identify evidence-handling and chain-of-custody practices.
- Apply notification deadlines (SEC, GDPR, HIPAA).
EXAM TIP: Containment comes before eradication, and eradication before recovery — you isolate the problem, remove it, then restore. Lessons learned is always the final phase.