Incident Analysis is conducted to ensure adequate response and support recovery activities. Measure effectiveness and update security incident response procedures to reflect lessons learned, and identify actions to take that will improve security controls after a security incident.

What Does This Mean?

• Notifications from detection systems are investigated
• The impact of the incident is understood
• Forensics are performed
• Incidents are categorized consistent with response plans