IR-2: INCIDENT RESPONSE TRAINING
TAILORED FOR INDUSTRIAL CONTROL SYSTEMS
ICS Control Baselines:
- Low
- Moderate
- High
The organization provides incident response training to information system users consistent with assigned roles and responsibilities:
- a. Within [Assignment: organization-defined time period] of assuming an incident response role or responsibility;
- b. When required by information system changes; and
- c. [Assignment: organization-defined frequency] thereafter.
SUPPLEMENTAL GUIDANCE
Incident response training provided by organizations is linked to the assigned roles and responsibilities of organizational personnel to ensure the appropriate content and level of detail is included in such training. For example, regular users may only need to know who to call or how to recognize an incident on the information system; system administrators may require additional training on how to handle/remediate incidents; and incident responders may receive more specific training on forensics, reporting, system recovery, and restoration. Incident response training includes user training in the identification and reporting of suspicious activities, both from external and internal sources.
ICS SUPPLEMENTAL GUIDANCE
No ICS Supplemental Guidance.
RELATED CONTROLS: IR-2
CONTROL ENHANCEMENTS
IR-2 (1) INCIDENT RESPONSE TRAINING | SIMULATED EVENTS
ISC Control Baseline:
- High
The organization incorporates simulated events into incident response training to facilitate effective response by personnel in crisis situations.
Supplemental Guidance: NONE
No ICS Supplemental Guidance.
IR-2 (2) INCIDENT RESPONSE TRAINING | AUTOMATED TRAINING ENVIRONMENTS
ISC Control Baseline:
- High
The organization employs automated mechanisms to provide a more thorough and realistic incident response training environment.
Supplemental Guidance: NONE
No ICS Supplemental Guidance.
REFERENCES:
- NIST Special Publication 800-82
- NIST Special Publication 800-16
- NIST Special Publication 800-50