77
InformatIon SecurIty PolIcy DeveloPment for comPlIance
b. Provides refresher training [Assignment: organization-dened
frequency].
IR-3 INCIDENT RESPONSE TESTING AND EXERCISES
Control: e organization tests and/or exercises the incident response
capability for the information system [Assignment: organization-
dened frequency] using [Assignment: organization-dened tests and/or
exercises] to determine the incident response eectiveness and docu-
ments the results.
IR-4 INCIDENT HANDLING
Control: e organization:
a. Implements an incident handling capability for security inci-
dents that includes preparation, detection and analysis, con-
tainment, eradication, and recovery;
b. Coo
rdinates incident handling activities with contingency ...