Information Security Fundamentals, 2nd Edition

Continuity of Operations Planning  ◾  183

offset the risk and potential effect. is could be as simple as updating an IDS sig-

nature file or implementing a new firewall rule. Evaluation of the residual risk asso-

ciated with a specific event (post countermeasure implementation) will determine

whether it should be escalated to the NOC manager. Upon consultation with the

NOC manager, a decision will be made whether or not to contact the IRM.

As part of the incident response process, the IRM will need to verify the initial

assessment of the event/incident’s effect and assigned risk. Declaration of an incident

will typically be reserved for events categori ...