{"catalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","download":{"releaseId":"sha256:77c1602449f9eb3f1137db475d9bf0562db8468f039c984fdbba64e37e5a422a","slug":"grc-incident-management-lifecycle","url":"/assets/agent_workflow-grc-incident-management-lifecycle-eab7367a.1268d373e01cbb76.json"},"kind":"record","record":{"attributes":{"department":"operations","domain":"grc","lineOfDefense":"operate"},"canonicalUrl":"https://workflow-library.com/all/?w=grc-incident-management-lifecycle","description":"Run the enterprise incident management lifecycle on a single governed incident record — an Issue item created at intake that every step enriches (there is no separate Incident type; the workflow instance anchors to that Issue). Open the record, analyze scope and impact, anchor the regulatory and remediation notification clocks to the detection date, contain/eradicate/recover, execute severity-based notifications, run lessons-learned and CAPA, classify the disposition, then prepare, hand off, and archive the governance package. Named deliverables: the scope-and-impact assessment, the root-cause analysis, the owned CAPA / remediation action plan, and the final evidence-and-decision governance package. In scope: operational and security incidents from detection through closure, including regulatory-notification clock management and corrective/preventive actions. Upstream: the incident originates on detection itself, but for a security-category incident this workflow consumes the containment-and-forensics handoff package produced by the Cybersecurity Incident Response workflow (linked in at the eradicate-and-recover step) rather than re-running SOC triage. Out of scope: real-time SOC triage and containment mechanics (owned by that Cybersecurity Incident Response workflow) and board-level reporting — the final governance package is handed off to the Quarterly Board & Audit-Committee GRC Reporting workflow, which reports the outcome without re-investigating.","details":{"canonicalUrl":"https://workflow-library.com/all/?w=grc-incident-management-lifecycle","capabilities":[],"controls":["UC-IR-04","UC-IR-05","UC-IR-06","UC-IR-07","UC-IR-08","UC-IR-09","UC-IR-10","UC-GOV-24","UC-ASSET-11","UC-BCDR-06","UC-BCDR-08","UC-BCDR-09","UC-DATA-15"],"domains":["grc"],"lineOfDefense":"operate","mappingStatus":"mapped","releaseId":"sha256:77c1602449f9eb3f1137db475d9bf0562db8468f039c984fdbba64e37e5a422a","roleIntegrity":{"activityCount":0,"ermPhases":[],"lineRoles":[],"serviceModes":[],"warnings":[]},"sourceTemplateId":"workflow-library:grc-incident-management-lifecycle","standards":["nist-800-53","iso-27001","gdpr","nydfs-500"],"teams":["operations","it","compliance-legal"]},"id":"wf:G7","mapUrl":"https://controlsmap.com/?v=1&node=wf%3AG7","slug":"grc-incident-management-lifecycle","sourceIds":["cobit-2019","coso-ic","dora","gdpr","hipaa","iso-27001","nis2","nist-800-53","nist-csf-2","nydfs-500","soc2"],"sourceUrl":null,"title":"Incident Management Lifecycle","type":"workflow"},"relationships":[{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:02f2f77c825de1afaf629d903735fd0633d1f7e91d742f2a981767d17149332f","properties":{},"sourceDetailPath":"/data/v1/records/wf-g7-9762f11b.json","sourceId":"wf:G7","targetDetailPath":"/data/v1/records/uc-uc-ir-05-0e11ebf5.json","targetId":"uc:UC-IR-05","type":"operates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:273c90188e658ee76215527852937cc5da8024f5e138f1dbcdc14637e66df674","properties":{},"sourceDetailPath":"/data/v1/records/wf-g7-9762f11b.json","sourceId":"wf:G7","targetDetailPath":"/data/v1/records/uc-uc-bcdr-09-c9025680.json","targetId":"uc:UC-BCDR-09","type":"operates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:32117b74316c0ed4fca30e389d844f825f65fc9cb76edf2c7568f26c308ccf2b","properties":{},"sourceDetailPath":"/data/v1/records/wf-g7-9762f11b.json","sourceId":"wf:G7","targetDetailPath":"/data/v1/records/uc-uc-ir-06-0b166c2a.json","targetId":"uc:UC-IR-06","type":"operates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:5900c12d0cec0820dedc1b80fb61ae168c2a3838afffe83957abdce90655dc89","properties":{},"sourceDetailPath":"/data/v1/records/wf-g7-9762f11b.json","sourceId":"wf:G7","targetDetailPath":"/data/v1/records/uc-uc-ir-09-6caefe96.json","targetId":"uc:UC-IR-09","type":"operates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:5db466de5a68a2dd57f8ab1550f17a800103f6022a0e9a9015105f029d409d4e","properties":{},"sourceDetailPath":"/data/v1/records/wf-g7-9762f11b.json","sourceId":"wf:G7","targetDetailPath":"/data/v1/records/uc-uc-asset-11-714d9672.json","targetId":"uc:UC-ASSET-11","type":"operates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:61045aecc3cb500e98b99991bc5de32b7a8503e5fc42878e1232e0ce60745a73","properties":{},"sourceDetailPath":"/data/v1/records/wf-g7-9762f11b.json","sourceId":"wf:G7","targetDetailPath":"/data/v1/records/uc-uc-bcdr-08-6e625399.json","targetId":"uc:UC-BCDR-08","type":"operates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:6b29309f092408f29a7b36a1e6cc57e0fcd6900deb9ae3478f974b68a368d287","properties":{},"sourceDetailPath":"/data/v1/records/wf-g7-9762f11b.json","sourceId":"wf:G7","targetDetailPath":"/data/v1/records/uc-uc-ir-04-6067c069.json","targetId":"uc:UC-IR-04","type":"operates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:85d001e92bba7f7b75b75d52d7abddd3d8acab5cf78033e85c8510a3c23e953c","properties":{},"sourceDetailPath":"/data/v1/records/wf-g7-9762f11b.json","sourceId":"wf:G7","targetDetailPath":"/data/v1/records/uc-uc-data-15-efb7b99a.json","targetId":"uc:UC-DATA-15","type":"operates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:88f4acbbafe9cadad6d161c0243b9cb59680cb265ad1485b366b06bec45fb7c8","properties":{},"sourceDetailPath":"/data/v1/records/wf-g7-9762f11b.json","sourceId":"wf:G7","targetDetailPath":"/data/v1/records/uc-uc-ir-08-01afe3d1.json","targetId":"uc:UC-IR-08","type":"operates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:9403cf904667719fc406465da866f40b906ceac5f0f09e4b11368ffad43c549c","properties":{},"sourceDetailPath":"/data/v1/records/wf-g7-9762f11b.json","sourceId":"wf:G7","targetDetailPath":"/data/v1/records/uc-uc-ir-10-072c0403.json","targetId":"uc:UC-IR-10","type":"operates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:d0efb67e45137161ae9555ed37f5b450841d2a542b5fa69f548eae823032d61c","properties":{},"sourceDetailPath":"/data/v1/records/wf-g7-9762f11b.json","sourceId":"wf:G7","targetDetailPath":"/data/v1/records/uc-uc-bcdr-06-c505e5bd.json","targetId":"uc:UC-BCDR-06","type":"operates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:e74461fd8134725e4382e89324b0401d067f371e2fdb2244355d6a61c95d2265","properties":{},"sourceDetailPath":"/data/v1/records/wf-g7-9762f11b.json","sourceId":"wf:G7","targetDetailPath":"/data/v1/records/uc-uc-gov-24-b737644b.json","targetId":"uc:UC-GOV-24","type":"operates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:f0f02444c8b5ce9ceb4cba399c979fd309ff981564a547e36c7e8e4efa777d0d","properties":{},"sourceDetailPath":"/data/v1/records/wf-g7-9762f11b.json","sourceId":"wf:G7","targetDetailPath":"/data/v1/records/uc-uc-ir-07-b4d61eff.json","targetId":"uc:UC-IR-07","type":"operates"}],"schemaVersion":1}