Trust
Incident Response
A response framework for triage, containment, evidence, notification, recovery and review.
Purpose
A response framework for triage, containment, evidence, notification, recovery and review.
Core areas
The scope is defined for each engagement and adapted to the operating environment.
- Triage
- Containment
- Notification assessment
- Recovery
Operating approach
Work begins with a defined problem, evidence boundary, accountable owner, security context and measurable decision or operating outcome.
Evidence boundary
This page describes capability and approach. It does not claim an undisclosed client, contract, deployment, certification, clearance or legal guarantee.