Incident response execution — detection through eradication, recovery, and lessons learned
Primary statement
IR execution operates as a documented sequence: (1) detection via monitoring and event reporting; (2) assessment and categorisation of events as incidents (ISO 27001 A.5.25); (3) response per documented procedures (A.5.26) with role assignments per the IR plan; (4) coordination with relevant third parties once incident is declared (NIST RS.MA-01); (5) recovery execution (NIST RC.RP-01); (6) lessons learned applied to strengthen controls (A.5.27 + NIST ID.IM-04). The IR plan is preparation; execution is the proof.
Audit-fatigue payoff
A single IR execution discipline — documented procedures + role assignments + recent incident records traced through the full sequence + lessons-learned integration — satisfies execution requirements across all 12 contributing frameworks. The auditor's test for "do you actually execute" reduces to: one IR plan + one recent incident traced end-to-end with role evidence + one lessons-learned record showing control improvements.
Strictness matrix
Scope
IR execution scope: incident classification + response team structure + escalation matrix + communication procedures + runbooks per incident category + post-incident review. Comprehensive coverage across the incident lifecycle.
Ceiling source: sebi_cscrf:CSCRF.RS.1
Rationale: SEBI CSCRF RS.1 specifies the most comprehensive IR plan scope, enumerating all lifecycle phases.
Threshold
Threshold for IR execution: detection → triage → response → containment → eradication → recovery → lessons-learned. Six phases (RBI ITGRCA RM.7). The phase model defines the execution sequence; triggering one phase requires completion of the prior.
Ceiling source: rbi_itgrca:ITGRCA.RM.7
Rationale: RBI ITGRCA RM.7 specifies the six-phase IR sequence most explicitly. Other frameworks address subsets; the six-phase model is the audit-defensible specification.
Method
Method: (1) IR Management plan with classification, team, escalation, communication, runbooks; (2) response per documented procedures (A.5.26); (3) coordination with third parties on declaration (NIST RS.MA-01); (4) recovery executed from IR process (NIST RC.RP-01); (5) lessons-learned integrated into control improvements (A.5.27); (6) regulator notification per applicable timelines (CERT-In 6h, RBI CIMS, SEBI, IRDAI, DPBI from May 2027).
Ceiling source: sebi_cscrf:CSCRF.RS.1
Rationale: SEBI CSCRF RS.1 method is the most prescriptive, integrating execution, third-party coordination, recovery, and lessons-learned. The runbooks-per-category requirement is uniquely strict.
Frequency
IR execution: event-driven (per incident). Lessons-learned cycle: per incident + cumulative quarterly review for trend analysis. IR plan rehearsal: per cl-incident-reporting-external cadence (annual tabletop minimum; cyber-range quarterly for highest tier).
Ceiling source: iso27001:A.5.27
Rationale: ISO 27001 A.5.27 specifies lessons-learned cadence linked to incident occurrence. Cumulative quarterly review for trends is the audit-defensible reference.
Evidence
Required evidence: (1) IR Management plan; (2) recent incident records traced through full lifecycle (detection timestamps, classification, response actions, communication, recovery, closure); (3) role-assignment evidence per incident; (4) lessons-learned records with control improvements; (5) regulator notification evidence per applicable jurisdiction; (6) post-incident review records.
Ceiling source: sebi_cscrf:CSCRF.RS.1
Rationale: SEBI CSCRF RS.1 evidence list combined with the lessons-learned discipline produces the most defensible package.
Auditor test pattern
Step 1: Inspect the IR Management plan. Step 2: Sample 1 incident from past 12 months; trace from detection to closure with timestamped role-execution evidence. Step 3: Inspect the lessons-learned record from that incident; verify control improvements identified and implemented. Step 4: Inspect one runbook category and verify it matches an executed incident's actions. Step 5: Verify regulator notifications per applicable jurisdictions met their timelines. Step 6: Inspect cumulative quarterly trend analysis (if implemented).
Common findings
Common 2024–26 findings: (1) IR plan exists but recent incident actions diverge from the documented procedure — execution improvises around the plan; (2) Lessons-learned record exists but identifies no control improvement (effectively a closure note); (3) Third-party coordination absent — MSSPs / forensics / law enforcement engagement happened ad-hoc; (4) Runbooks generic; not category-specific; (5) Recovery executed but not from the IR plan — operational teams ran their own recovery; (6) Lessons-learned not aggregated for trend analysis.