3.6.1 Establish Operational Incident Handling Capability

3.6.1 Establish an operational incident-handling capability for organizational information systems that includes adequate preparation, detection, analysis, containment, recovery, and user response activities.

To go back to the NIST 800-171 Controls page click here.

Guides

• NIST SP 800-61r2 – Incident Handling Guide

Example Tools

• RSA Netwitness SecOps Manager

Sample Policy & Procedures

• Incident Management – Best Practices