ДСТУ ISO/IEC 27035-2:2024 Информационные технологии. Методы защиты. Управление инцидентами информационной безопасности. Часть 2. Руководство по планированию и подготовке к реагированию на инциденты (ISO/IEC 2...
ДСТУ ISO/IEC 27035-2:2024
(ISO/IEC 27035-2:2023, IDT)
Інформаційні технології. Методи захисту. Керування інцидентами інформаційної безпеки. Частина 2. Настанова щодо планування та підготовки до реагування на інциденти
Не є офіційним виданням.
Офіційне видання розповсюджує національний орган стандартизації
(ДП «УкрНДНЦ» http://uas.gov.ua)
Contents
Foreword
Introduction
1 Scope
2 Normative references
3 Terms, definitions and abbreviated terms
3.1 Terms and definitions
3.2 Abbreviated terms
4 Information security incident management policy
4.1 General
4.2 Interested parties
4.3 Information security incident management policy content
5 Updating of information security policies
5.1 General
5.2 Linking of policy documents
6 Creating information security incident management plan
6.1 General
6.2 Information security incident management plan built on consensus
6.3 Interested parties
6.4 Information security incident management plan content
6.5 Incident classification scale
6.6 Incident forms
6.7 Documented processes and procedures
6.8 Trust and confidence
6.9 Handling confidential or sensitive information
7 Establishing an incident management capability
7.1 General
7.2 Incident management team establishment
7.2.1 IMT structure
7.2.2 IMT roles and responsibilities
7.3 Incident response team establishment
7.3.1 IRT structure
7.3.2 IRT types and roles
7.3.3 IRT staff competencies
8 Establishing internal and external relationships
8.1 General
8.2 Relationship with other parts of the organization
8.3 Relationship with external interested parties
9 Defining technical and other support
9.1 General
9.2 Technical support
9.3 Other support
10 Creating information security incident awareness and training
11 Testing the information security incident management plan
11.1 General
11.2 Exercise
11.2.1 Defining the goal of the exercise
11.2.2 Defining the scope of an exercise
11.2.3 Conducting an exercise
11.3 Incident response capability monitoring
11.3.1 Implementing an incident response capability monitoring programme
11.3.2 Metrics and governance of incident response capability monitoring
12 Learn lessons
12.1 General
12.2 Identifying areas for improvement
12.3 Identifying and making improvements to the information security incident management plan
12.4 IMT evaluation
12.5 Identifying and making improvements to information security control implementation
12.6 Identifying and making improvements to information security risk assessment and management review results
12.7 Other improvements
Annex A (informative) Considerations related to legal or regulatory requirements
A.1 Introduction
A.2 Data protection and privacy of personal information
A.3 Record keeping
A.4 Controls to ensure fulfilment of commercial contractual obligations
A.5 Legal issues related to policies and procedures
A.6 Disclaimers are checked for legal validity
A.7 Contracts with external support personnel
A.8 Non-disclosure agreements
A.9 Law enforcement requirements
A.10 Liability aspects
A.11 Specific regulatory requirements
A.12 Prosecutions, or internal disciplinary procedures
A.13 Legal aspects
A.14 Acceptable use policy
Annex B (informative) Example forms for information security events, incidents and vulnerability reports
B.1 Introduction
B.2 Example items in records
B.2.1 Example items of the record for information security event
B.2.2 Example items of the record for information security incident
B.2.3 Example items of the record for information security vulnerability
B.3 How to use forms
B.3.1 Format of date and time
B.3.2 Notes for completion
B.4 Example forms
B.4.1 Example form for information security event report
B.4.2 Example form for information security incident report
B.4.3 Example form for information security vulnerability report
Annex C (informative) Example approaches to the categorization, evaluation and prioritization of information security events and incidents
C.1 Introduction
C.2 Categorization of information security incidents
C.3 Evaluation and prioritization of information security incidents
Bibliography
Полная версия документа доступна в тарифе «ВСЕ ВКЛЮЧЕНО».