164.308(a)(6)(i) Security Incident Procedures (Standard)
Administrative safeguard · Standard
The requirement as we hold it
Security Incident Procedures (Standard). Implement policies to address security incidents. NIST recommends an incident response plan aligned to NIST SP 800-61 with detection, analysis, containment, eradication, and recovery phases.
The examiner asks
- Show me the policy that addresses security incidents.
- Who runs the incident response, and is it a plan or one person's memory?
Evidence to bring
- the incident response policy
- the named incident lead
Source: 164.308(a)(6)(i) at eCFR. Our statement of the clause, not the instrument verbatim.