Define Mechanisms for Communicating During Incident Response
Description
Determine which primary and secondary mechanisms will be used to communicate and report during a security incident. Mechanisms can include phone calls, emails, or letters. Keep in mind that certain mechanisms, such as emails, can be affected during a security incident. Review annually, or when significant enterprise changes occur that could impact this Safeguard.
Implementation Checklist
Tool Recommendations
Security orchestration, automation, and response platform with playbook automation and case management
Palo Alto Networks · Enterprise subscription
Security orchestration and automated response platform with playbooks, case management, and 350+ integrations
Cisco (Splunk) · Event-based subscription
Security incident response and vulnerability response with orchestration, workflow automation, and CMDB integration
ServiceNow · Enterprise subscription
Threats & Vulnerabilities (CIS RAM)
Threat Scenarios
Communication Blackout During Email System Compromise
AvailabilityAn attacker compromises the email system during a breach, and the incident response team cannot coordinate because email was the only planned communication channel and no secondary mechanism was defined.
Sensitive Incident Details Leaked Through Insecure Channel
ConfidentialityIncident responders discuss sensitive breach details over an unsecured communication channel because no predefined secure mechanisms were established, and the attacker monitors the communications.
Vulnerabilities (When Safeguard Absent)
No Defined Communication Mechanisms for Incident Response
Without predefined primary and secondary communication channels, incident response teams have no reliable way to coordinate when standard communication systems are compromised or unavailable.
No Out-of-Band Communication Capability
Absence of a secondary communication mechanism means a single point of failure exists; if the primary channel is compromised or disrupted during an incident, coordination collapses.
Evidence Requirements
| Type | Evidence Item | Collection Frequency |
|---|---|---|
| Document | Response procedure/playbook documentation | Reviewed bi-annually |
| Record | Response action logs showing procedure execution | Per incident |
| Document | Incident response plan and playbooks | Reviewed bi-annually |
| Record | Incident reports and post-incident review documentation | Per incident |
| Technical | Email security configuration (SPF, DKIM, DMARC records) | Verified quarterly |
| Document | Governing policy document (current, approved, communicated) | Reviewed annually |