CPS 234 para 23 Detection and Response Mechanisms
The entity must have robust mechanisms to detect information security incidents and respond to them in a timely way.
3
artefacts
2
held by a system
0
at each review
easy
to go live
SIEM / log platform
where the evidence lives
teal = a system already holds it · olive = produced at each review
system holds itEvidence a system already holds
- Detection tooling and monitoring coverage evidence · SIEM / log platform
- Incident records showing detection and response times · Document repository
periodic reviewEvidence produced at each review
none for this control
governing documentDocuments that govern the control
- Defined response timeliness expectations · Document repository
First move
Automate the pull from your SIEM / log platform. Retention and alert rules exported from the SIEM; review evidence is the closed-alert record with reviewer and time.
Common gaps auditors find
- Detection coverage gaps across classified assets
- No measurement of detection or response timeliness
Do this for your whole sheet
Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.
Build my evidence sheetCPS 234 para 22 Evaluation of Third Party Control Design · CPS 234 para 24 Information Security Response Plans