Investigate incidents affecting IT and OT under company procedures wherever possible, with external experts if needed, sharing the disk image taken during containment with a preserved chain of custody so evidence can stand in court (assume a case could follow a significant incident). Investigations should improve understanding of maritime cyber risk, identify lessons including training improvements, and update technical and procedural measures to prevent recurrence.
This control maps to 1 controls across 1 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.
The graph holds this control, the 1 it maps to, and the evidence behind each claim, over MCP and REST.