{"catalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","download":{"releaseId":"sha256:24f03436d3713f92be067a14847e35f7b71d0b34c3bab5fe0e06bcc04156c45f","slug":"controls-cybersecurity-incident-response","url":"/assets/agent_workflow-controls-cybersecurity-incident-response-b5d9e7a9.5cbfc05aac065ff5.json"},"kind":"record","record":{"attributes":{"department":"it","domain":"controls","lineOfDefense":"operate"},"canonicalUrl":"https://workflow-library.com/all/?w=controls-cybersecurity-incident-response","description":"Cybersecurity incident-response cycle as a decision-aware workflow spanning detection and validation, scoping, incident declaration and response-plan activation, containment with evidence preservation, eradication and recovery, POA&M updates for the control deficiencies the incident exposed, and a technical lessons-learned retrospective, closed through a disposition decision and archival. The workflow instance runs on the incident record — an Issue item (issue_type=exception, source=management_identified, severity per the org scheme) created at detection, since the schema has no native Incident type — and enriches that one record through to archival rather than creating duplicates. In scope: security events and confirmed incidents affecting the system boundary and its NIST 800-53 IR-family controls — the detection sources (logging/monitoring Control items, UC-LOG-06), affected systems (Process items, UC-ASSET-11), containment and recovery actions, forensic evidence, the deficiency Issues that become the POA&M, and their linked Risk items. Out of scope: the enterprise incident-management ticketing lifecycle and external breach-notification/legal reporting, which run in their own workflows. Where an Incident Management Lifecycle workflow is running, this cycle consumes its handoff package (initial ticket, reporter, affected systems); it hands the closed incident's control-deficiency findings — the open POA&M Issues (issue_type=deficiency) — to the Continuous Controls Monitoring (ISCM) Cycle as shared items it queries directly.","details":{"canonicalUrl":"https://workflow-library.com/all/?w=controls-cybersecurity-incident-response","capabilities":[],"controls":["UC-IR-04","UC-IR-05","UC-IR-06","UC-IR-07","UC-IR-09","UC-IR-10","UC-LOG-06","UC-RISK-14","UC-ASSET-11","UC-BCDR-06","UC-BCDR-07","UC-BCDR-08"],"domains":["controls"],"lineOfDefense":"operate","mappingStatus":"mapped","releaseId":"sha256:24f03436d3713f92be067a14847e35f7b71d0b34c3bab5fe0e06bcc04156c45f","roleIntegrity":{"activityCount":0,"ermPhases":[],"lineRoles":[],"serviceModes":[],"warnings":[]},"sourceTemplateId":"workflow-library:controls-cybersecurity-incident-response","standards":["nist-800-53","nist-csf-2"],"teams":["it"]},"id":"wf:C3","mapUrl":"https://controlsmap.com/?v=1&node=wf%3AC3","slug":"controls-cybersecurity-incident-response","sourceIds":["cobit-2019","coso-ic","dora","gdpr","iso-27001","nist-800-53","nist-csf-2","soc2"],"sourceUrl":null,"title":"Cybersecurity Incident Response","type":"workflow"},"relationships":[{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:2c69aee2901ae63887c71e406df78dc83387230ca2689f7fe4d7f01e44328caa","properties":{},"sourceDetailPath":"/data/v1/records/wf-c3-4a88b225.json","sourceId":"wf:C3","targetDetailPath":"/data/v1/records/uc-uc-risk-14-a5d6281b.json","targetId":"uc:UC-RISK-14","type":"operates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:32463a2f8813de9943353d48f9f98997b223cdfe5cc1fbeabc5bb5d236038ed7","properties":{},"sourceDetailPath":"/data/v1/records/wf-c3-4a88b225.json","sourceId":"wf:C3","targetDetailPath":"/data/v1/records/uc-uc-ir-05-0e11ebf5.json","targetId":"uc:UC-IR-05","type":"operates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:464d732549f0b141eb6c42247c0aebb78626d0ef47ff2224f67715f149847c02","properties":{},"sourceDetailPath":"/data/v1/records/wf-c3-4a88b225.json","sourceId":"wf:C3","targetDetailPath":"/data/v1/records/uc-uc-ir-07-b4d61eff.json","targetId":"uc:UC-IR-07","type":"operates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:4c6d87bf5359f4098040aa738912e3543b78688cfb06fdec4fd7eaac619d8d55","properties":{},"sourceDetailPath":"/data/v1/records/wf-c3-4a88b225.json","sourceId":"wf:C3","targetDetailPath":"/data/v1/records/uc-uc-bcdr-08-6e625399.json","targetId":"uc:UC-BCDR-08","type":"operates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:60dbb5404f8d594610367bd670338d7a466c294fff4d450727ec01af5c42631b","properties":{},"sourceDetailPath":"/data/v1/records/wf-c3-4a88b225.json","sourceId":"wf:C3","targetDetailPath":"/data/v1/records/uc-uc-log-06-735bbc3e.json","targetId":"uc:UC-LOG-06","type":"operates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:6626e25e6ebfa7f1917fafc1ac406bb362b6988f448a376918ba7aaa49b3b28e","properties":{},"sourceDetailPath":"/data/v1/records/wf-c3-4a88b225.json","sourceId":"wf:C3","targetDetailPath":"/data/v1/records/uc-uc-bcdr-07-e5d74596.json","targetId":"uc:UC-BCDR-07","type":"operates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:740e58e14751893cb5175bc1472c681f44be6a30ad1ff7dca82623e3b780ddc5","properties":{},"sourceDetailPath":"/data/v1/records/wf-c3-4a88b225.json","sourceId":"wf:C3","targetDetailPath":"/data/v1/records/uc-uc-asset-11-714d9672.json","targetId":"uc:UC-ASSET-11","type":"operates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:9f4c9e165d71a26a8ae4396e5317ceb0d2d2a2e344201e8ad906a161ee1f775f","properties":{},"sourceDetailPath":"/data/v1/records/wf-c3-4a88b225.json","sourceId":"wf:C3","targetDetailPath":"/data/v1/records/uc-uc-bcdr-06-c505e5bd.json","targetId":"uc:UC-BCDR-06","type":"operates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:b746028679f157109859c2538d9c13e66819262672ce20517e71578ef35c4acc","properties":{},"sourceDetailPath":"/data/v1/records/wf-c3-4a88b225.json","sourceId":"wf:C3","targetDetailPath":"/data/v1/records/uc-uc-ir-09-6caefe96.json","targetId":"uc:UC-IR-09","type":"operates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:cc7c3ee700e38ba8fafcfd0fee70b0bcb9c6547e0b2871c327c4baf7358cf7bd","properties":{},"sourceDetailPath":"/data/v1/records/wf-c3-4a88b225.json","sourceId":"wf:C3","targetDetailPath":"/data/v1/records/uc-uc-ir-06-0b166c2a.json","targetId":"uc:UC-IR-06","type":"operates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:d85af51bfc8d61535a454fb63116878dc0365a327e3695e2415e3f11fc06ffe7","properties":{},"sourceDetailPath":"/data/v1/records/wf-c3-4a88b225.json","sourceId":"wf:C3","targetDetailPath":"/data/v1/records/uc-uc-ir-10-072c0403.json","targetId":"uc:UC-IR-10","type":"operates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:ec837bcc8234af719cea8e53ce450e58abd265a7e40ac6d8dff3eef18e90465c","properties":{},"sourceDetailPath":"/data/v1/records/wf-c3-4a88b225.json","sourceId":"wf:C3","targetDetailPath":"/data/v1/records/uc-uc-ir-04-6067c069.json","targetId":"uc:UC-IR-04","type":"operates"}],"schemaVersion":1}