💼 RS.AN-03: Analysis is performed to establish what has taken place during an incident and the root cause of the incident
- Contextual name: 💼 RS.AN-03: Analysis is performed to establish what has taken place during an incident and the root cause of the incident
- ID:
/frameworks/nist-csf-v2.0/rs-an/03 - Located in: 💼 Incident Analysis (RS.AN)
Description
- Determine the sequence of events that occurred during the incident and which assets and resources were involved in each event
- Attempt to determine what vulnerabilities, threats, and threat actors were directly or indirectly involved in the incident
- Analyze the incident to find the underlying, systemic root causes
- Check any cyber deception technology for additional information on attacker behavior
Similar
- Sections
/frameworks/nist-csf-v1.1/rs-an/03/frameworks/nist-sp-800-53-r5/au/07/frameworks/nist-sp-800-53-r5/ir/04
Similar Sections (Take Policies From)
| Section | Sub Sections | Internal Rules | Policies | Flags |
|---|---|---|---|---|
| 💼 NIST CSF v1.1 → 💼 RS.AN-3: Forensics are performed | ||||
| 💼 NIST SP 800-53 Revision 5 → 💼 AU-7 Audit Record Reduction and Report Generation | 2 | 1 | 1 | |
| 💼 NIST SP 800-53 Revision 5 → 💼 IR-4 Incident Handling | 15 |
Sub Sections
| Section | Sub Sections | Internal Rules | Policies | Flags |
|---|