[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"framework:cis\u002F17":3},{"item":4,"lessons":16,"controls":67,"related":98},{"family":5,"item":6,"code":7,"title":8,"citations":9,"publisher":10,"summary_md":11,"official_text":12,"official_attribution":12,"official_url":13,"link_label":14,"note":12,"updated_at":15},"cis","17","Control 17","Incident Response Management",457,"Center for Internet Security (CIS)","**What it asks for.** This control asks organisations to build and maintain an incident response capability, including policies, plans, procedures, defined roles, training and communications, to prepare for, detect and quickly respond to an attack.\n\n**In practice.** There is a documented plan with named roles and deputies, contact details for internal and external parties such as legal, insurers, regulators and law enforcement, and a clear mechanism for staff to report incidents. Exercises such as tabletop scenarios are held regularly and post incident reviews lead to tracked improvements. Evidence includes the plan, contact lists, exercise reports and lessons learned records.\n\n**Common gaps.** Plans are often written but never exercised, and contact lists go out of date. Regulatory notification duties and decision authority during a crisis are frequently unclear until an incident actually happens.",null,"https:\u002F\u002Fwww.cisecurity.org\u002Fcontrols\u002Fincident-response-management","Read the control at CIS","2026-10-18T15:18:43.663+00:00",{"total":17,"list":18},1235,[19,23,27,31,35,39,43,47,51,55,59,63],{"slug":20,"title":21,"published_at":22},"operation-tornado-354-dark-web-criminals-arrested-through-persistent-law-enforcement-intelligence-ga","Operation TorNado: 354 Dark Web Criminals Arrested Through Persistent Law Enforcement Intelligence Gathering","2026-11-13T12:21:18.576+00:00",{"slug":24,"title":25,"published_at":26},"operation-endgame-dismantles-malware-as-a-service-infrastructure-stealing-millions-of-credentials","Operation Endgame Dismantles Malware-as-a-Service Infrastructure Stealing Millions of Credentials","2026-11-13T11:20:42.574+00:00",{"slug":28,"title":29,"published_at":30},"global-dark-web-crackdown-nets-354-arrests-and-210m-in-assets","Global Dark Web Crackdown Nets 354 Arrests and €210M in Assets","2026-11-13T09:20:58.871+00:00",{"slug":32,"title":33,"published_at":34},"japans-cyberattack-surge-highlights-gaps-in-vulnerability-management-and-ai-assisted-threat-detectio","Japan's Cyberattack Surge Highlights Gaps in Vulnerability Management and AI-Assisted Threat Detection","2026-11-12T21:21:33.229+00:00",{"slug":36,"title":37,"published_at":38},"ai-accelerated-attacks-are-outpacing-human-speed-soc-defenses","AI-Accelerated Attacks Are Outpacing Human-Speed SOC Defenses","2026-11-12T17:22:09.493+00:00",{"slug":40,"title":41,"published_at":42},"qilin-raas-admin-unmasked-through-reused-digital-identities","Qilin RaaS Admin Unmasked Through Reused Digital Identities","2026-11-12T14:21:18.908+00:00",{"slug":44,"title":45,"published_at":46},"qilin-administrator-unmasked-through-operational-security-failures","Qilin Administrator Unmasked Through Operational Security Failures","2026-11-11T19:20:43.966+00:00",{"slug":48,"title":49,"published_at":50},"eu-cyber-resilience-act-demands-247-incident-reporting-readiness","EU Cyber Resilience Act demands 24\u002F7 incident reporting readiness","2026-11-11T08:21:45.016+00:00",{"slug":52,"title":53,"published_at":54},"cisa-refines-incident-reporting-to-detect-coordinated-attack-campaigns","CISA Refines Incident Reporting to Detect Coordinated Attack Campaigns","2026-11-10T14:23:17.095+00:00",{"slug":56,"title":57,"published_at":58},"turla-group-hijacks-exchange-servers-for-silent-email-espionage","Turla Group Hijacks Exchange Servers for Silent Email Espionage","2026-11-10T12:22:49.31+00:00",{"slug":60,"title":61,"published_at":62},"spyware-goes-mainstream-everyday-users-now-prime-targets","Spyware Goes Mainstream: Everyday Users Now Prime Targets","2026-11-10T12:22:28.417+00:00",{"slug":64,"title":65,"published_at":66},"barbuti-spa-fined-5000-for-ignoring-gdpr-erasure-request","Barbuti S.p.A. Fined €5,000 for Ignoring GDPR Erasure Request","2026-11-10T12:21:45.559+00:00",[68,73,78,83,88,93],{"slug":69,"name":70,"problem":71,"stories":72},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",406,{"slug":74,"name":75,"problem":76,"stories":77},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",227,{"slug":79,"name":80,"problem":81,"stories":82},"patch-management","Automated patch management","Known holes get closed in days, not months.",211,{"slug":84,"name":85,"problem":86,"stories":87},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",194,{"slug":89,"name":90,"problem":91,"stories":92},"threat-intelligence","Threat intelligence","Attack campaigns reach your sector, suppliers or software before your team hears about them.",192,{"slug":94,"name":95,"problem":96,"stories":97},"incident-response-retainer","Incident response retainer","Experts are on call before the worst day, not searched for during it.",145,[99,105,111,117,123,129,135,140],{"family":100,"item":101,"code":102,"title":103,"together":104},"nist-800-53","si-2","SI-2","Flaw Remediation",748,{"family":106,"item":107,"code":108,"title":109,"together":110},"nist-csf","pr-aa","PR.AA-01","PR.AA: Identity Management, Authentication, and Access Control",696,{"family":112,"item":113,"code":114,"title":115,"together":116},"iso-27001","a-8-8","Annex A 8.8","ISO\u002FIEC 27001:2022 Annex A 8.8: Management of technical vulnerabilities",685,{"family":118,"item":119,"code":120,"title":121,"together":122},"nis2","21-2-b","Article 21(2)(b)","Incident handling (Article 21(2)(b))",578,{"family":124,"item":125,"code":126,"title":127,"together":128},"gdpr","32","Article 32","Security of processing",448,{"family":130,"item":131,"code":132,"title":133,"together":134},"mitre-attack","t1566","T1566","Phishing",429,{"family":5,"item":136,"code":137,"title":138,"together":139},"14","Control 14","Security Awareness and Skills Training",426,{"family":5,"item":141,"code":142,"title":143,"together":72},"7","Control 7","Continuous Vulnerability Management"]