12.10.4 Incident responder training
Personnel responsible for responding to suspected or confirmed security incidents are appropriately and periodically trained on their incident response responsibilities.
5
artefacts
0
held by a system
3
at each review
hard
to go live
HR system / LMS
where the evidence lives
teal = a system already holds it · olive = produced at each review
system holds itEvidence a system already holds
none for this control
periodic reviewEvidence produced at each review
- Completion records per responder · HR system / LMS
- Annual refresher schedule · HR system / LMS
- Tabletop participation records · HR system / LMS
governing documentDocuments that govern the control
- IR training curriculum · HR system / LMS
- Specialized training certifications (GCIH, etc.) · HR system / LMS
First move
This control is evidenced by people and documents, not systems. Put the document under version control with an owner and review date, and log each review as a record with reviewer and date. Do not try to automate it.
Common gaps auditors find
- No formal training
- Refreshers skipped
- Certifications stale
Do this for your whole sheet
Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.
Build my evidence sheet12.10.3 24/7 incident response coverage · 12.10.4.1 Periodic IR responder skill review