Incident handling, monitoring and logging

Catalog reference

Have an incident handling policy that sets roles, responsibilities and procedures to detect, analyse, contain, respond to, recover from, document and report incidents, in line with your continuity plan. It covers an incident classification system, communication and escalation plans, assigned and competent staff, and playbooks, escalation charts, contact lists and templates. Monitor your systems with tools and procedures, automated where feasible, keep reviewed logs of the assets you choose by risk (network traffic, user and privilege changes, access, authentication, privileged activity, critical configuration and backup files, security tool events, system use, physical access, network equipment, log switching, and environmental events), set alert thresholds, protect the logs and keep them for a set period, and synchronise clocks and keep logging redundant. Give staff, suppliers and customers a simple way to report suspicious events. Assess and classify events, respond promptly in documented phases (containment, elimination, recovery), set communication plans with the CSIRT or competent authority and with internal and outside stakeholders, record the response and the evidence, test the procedures, and review each incident afterwards for root cause and lessons. Decide this in only if the Account is one of the eleven entity types Implementing Regulation 2024/2690 covers: DNS service providers, top-level domain (TLD) name registries, cloud computing service providers, data centre service providers, content delivery network providers, managed service providers, managed security service providers, online marketplaces, online search engines, social networking service platforms, and trust service providers.

Narrative — how we satisfy this requirement