[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"framework:nist-csf\u002Frs-ma":3},{"item":4,"lessons":16,"controls":43,"related":70},{"family":5,"item":6,"code":7,"title":8,"citations":9,"publisher":10,"summary_md":11,"official_text":12,"official_attribution":12,"official_url":13,"link_label":14,"note":12,"updated_at":15},"nist-csf","rs-ma","RS.MA","RS.MA: Incident Management",1,"US National Institute of Standards and Technology (NIST)","**What it asks for.** This category asks that responses to detected cybersecurity incidents are managed. It covers executing the incident response plan with relevant third parties, triaging and validating reports, categorising and prioritising incidents, escalating as needed and applying criteria for starting recovery.\n\n**In practice.** A mature process has a clear entry point for incident reports, a triage step that confirms whether an event is an incident, and defined severity categories that drive escalation and resourcing. Incident commanders coordinate internal teams, suppliers and service providers according to agreed roles. Criteria for moving from response to recovery are documented. Evidence includes the incident response plan, a ticketing or case management system with timelines, escalation records, supplier contacts and post-incident reviews.\n\n**Common gaps.** Gaps typically include inconsistent severity ratings, slow escalation to decision makers and unclear handoffs with managed service providers. Many organisations also lack defined criteria for when to begin recovery.",null,"https:\u002F\u002Fwww.nist.gov\u002Fcyberframework","Open the Cybersecurity Framework at NIST","2026-10-18T15:18:43.664+00:00",{"total":17,"list":18},6,[19,23,27,31,35,39],{"slug":20,"title":21,"published_at":22},"faa-communications-failure-halts-all-us-flights","FAA Communications Failure Halts All U.S. Flights","2026-11-13T22:20:21.497+00:00",{"slug":24,"title":25,"published_at":26},"qilin-ransomware-steals-personal-data-from-university-of-texas-at-arlington","Qilin Ransomware Steals Personal Data from University of Texas at Arlington","2026-11-13T18:20:39.241+00:00",{"slug":28,"title":29,"published_at":30},"polands-epuap-cyberattack-highlights-importance-of-rapid-detection-and-precautionary-shutdown","Poland's ePUAP Cyberattack Highlights Importance of Rapid Detection and Precautionary Shutdown","2026-11-11T14:21:36.986+00:00",{"slug":32,"title":33,"published_at":34},"ransomware-attack-hits-vanderbilt-university-exposing-millions-of-records","Ransomware Attack Hits Vanderbilt University, Exposing Millions of Records","2026-11-10T13:20:22.168+00:00",{"slug":36,"title":37,"published_at":38},"hacktivist-leak-exposes-41000-dhs-records-including-undercover-agent-identities","Hacktivist Leak Exposes 41,000 DHS Records Including Undercover Agent Identities","2026-10-29T11:21:11.217+00:00",{"slug":40,"title":41,"published_at":42},"nist-nsa-cisa-issue-guidance-on-ai-incident-readiness-for-high-risk-ai-systems","NIST, NSA & CISA Issue Guidance on AI Incident Readiness for High-Risk AI Systems","2026-10-16T18:21:54.014+00:00",[44,49,54,58,62,66],{"slug":45,"name":46,"problem":47,"stories":48},"incident-response-retainer","Incident response retainer","Experts are on call before the worst day, not searched for during it.",3,{"slug":50,"name":51,"problem":52,"stories":53},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",2,{"slug":55,"name":56,"problem":57,"stories":53},"immutable-backup","Immutable backup and recovery","Ransomware cannot delete or encrypt your way back.",{"slug":59,"name":60,"problem":61,"stories":9},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",{"slug":63,"name":64,"problem":65,"stories":9},"identity-governance","Identity governance and single sign-on","People who leave or change roles lose access everywhere at once, and forgotten accounts stop piling up.",{"slug":67,"name":68,"problem":69,"stories":9},"log-management","Log management and security data pipelines","Security logs are so expensive to collect and keep that teams drop the ones they need when an incident happens.",[71,77,82,87,91,96,101,105],{"family":72,"item":73,"code":74,"title":75,"together":76},"nis2","21-2-b","Article 21(2)(b)","Incident handling (Article 21(2)(b))",4,{"family":78,"item":79,"code":80,"title":81,"together":53},"gdpr","32","Article 32","Security of processing",{"family":83,"item":84,"code":85,"title":86,"together":53},"cis","3","Control 3","Data Protection",{"family":72,"item":88,"code":89,"title":90,"together":53},"21-2-c","Article 21(2)(c)","Business continuity, backups and crisis management (Article 21(2)(c))",{"family":92,"item":93,"code":94,"title":95,"together":53},"nist-800-53","ir-4","IR-4","Incident Handling",{"family":97,"item":98,"code":99,"title":100,"together":9},"eu-ai-act","9","Article 9","Risk management system",{"family":83,"item":102,"code":103,"title":104,"together":9},"17","Control 17","Incident Response Management",{"family":83,"item":106,"code":107,"title":108,"together":9},"6","Control 6","Access Control Management"]