IR-9 Information Spillage Response. Respond to information spills by: Assigning [organization-defined] with responsibility for responding to information spills; Identifying the specific information involved in the system contamination; Alerting [organization-defined] of the information spill using a
Information Spillage Response. Respond to information spills by: Assigning [organization-defined] with responsibility for responding to information spills; Identifying the specific information involved in the system cont.
5
artefacts
1
held by a system
1
at each review
hard
to go live
Policy repository / GRC workspace
where the evidence lives
teal = a system already holds it · olive = produced at each review
system holds itEvidence a system already holds
- Alerting records showing the defined personnel were notified by a method not itself using the contaminated system · SIEM / log platform
periodic reviewEvidence produced at each review
- Isolation, eradication and decontamination records for a real or exercised spill · Document repository
governing documentDocuments that govern the control
- Named personnel or roles assigned responsibility for responding to information spills · Policy repository / GRC workspace
- Procedure for identifying the specific information involved and the components contaminated · Policy repository / GRC workspace
- Post spill actions including access removal for personnel exposed and the additional defined actions · Document repository
First move
Mostly documents and reviews. Pull the 1 system-held artefact from your SIEM / log platform on a schedule; put the documents under version control with an owner and review date, and log each review as a dated record with a named reviewer.
Common gaps auditors find
- Alert sent using the contaminated system or mailbox, spreading the spill further
- Contaminated system cleaned while backups, mail copies and export files keep the spilled information
- Personnel exposed to the information are never tracked, so exposure cannot be bounded afterwards
Do this for your whole sheet
Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.
Build my evidence sheetIR-8 Incident response plan · MA-1 Policy and procedures for maintenance