Free compliance framework explorer — browse controls, evidence, and implementation guidance.Subscribe for updates →
SOC 247
ITSP.10.17198
ISO 42001soon
ISO 27001soon

Browse

98 controls

03.06.05Incident response planITSP.10.171Incident response

Official Requirement

A. Develop an incident response plan that: 1. provides the organization with a roadmap for implementing its incident response capability 2. describes the structure and organization of the incident response capability 3. provides a high-level approach for how the incident response capability fits into the overall organization 4. defines reportable incidents 5. addresses the sharing of incident information 6. designates responsibilities to organizational entities, personnel, or roles. B. Distribute copies of the incident response plan to designated incident response personnel (identified by name and/or by role) and organizational elements. C. Update the incident response plan to address system and organizational changes or problems encountered during plan implementation, execution, or testing. D. Protect the incident response plan from unauthorized disclosure.

Source: Canadian Centre for Cyber Security ITSP.10.171 (2025), adapted from NIST SP 800-171 Rev. 3

In Plain English

You need a formal, written incident response plan that defines how your organization handles security incidents. It must cover the team structure, roles, what constitutes a reportable incident, how information is shared, how effectiveness is measured, and what resources are needed. The plan must be distributed to relevant personnel, updated after changes or exercises, and protected from unauthorized access.

Cross-framework mappings:ISO 42001 · coming soonISO 27001 · coming soon
View in Map →

Help us build what matters.

Vote for the next framework, subscribe for updates, and let us know if you'd contribute.

Truvo CyberTruvo CyberBuilt and maintained by Truvo Cyber
Authors·Connect with us
Updated: Mar 22, 2026Reviewed: Mar 22, 2026v1.0.0
Share this tool

The Trust Services Criteria referenced in this tool are published by the American Institute of Certified Public Accountants (AICPA) and incorporate principles from the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Criteria descriptions are reproduced for reference purposes. All implementation guidance, evidence recommendations, and control language are original work by Truvo Cyber. ISO 27001 and ISO 42001 are standards published by the International Organization for Standardization (ISO). Framework and standard names are the property of their respective owners. This tool is not affiliated with, endorsed by, or certified by AICPA, COSO, or ISO.

© 2026 Truvo Cyber. All rights reserved.

On-premises implementation and evidence

Documented incident response plan

Implementation steps

  1. Draft an incident response plan addressing all required elements: structure, roles, reportable incidents, information sharing, metrics, and resources
  2. Obtain management approval and sign-off on the plan; classify the plan as restricted to prevent unauthorized disclosure
  3. Distribute the plan to all IR team members and relevant departments (IT, legal, HR, communications); collect signed acknowledgements
  4. Update the plan after tests, real incidents, or organizational changes; redistribute and track updated acknowledgements

Tools / systems

Evidence artifacts

Evidence frequency: Annual review and approval; per-event updates; annual distribution verification