Canada ITSP.10.033 Security and Privacy Controls and Assurance Activities Catalogue IR-04: IR-04 Incident handling

The organisation implements an incident handling capability consistent with the incident response plan covering preparation, detection and analysis, containment, eradication and recovery, coordinates it with contingency planning, feeds lessons from incident handling into procedures, training and testing and implements the changes, and makes the rigour, scope and results of incident handling comparable and predictable across the organisation. The GC discussion treats incidents involving personal information as privacy breaches handled through preliminary assessment and containment, full assessment, notification of affected individuals, mitigation and prevention, notification to the Privacy Commissioner or TBS, and lessons learned, with different notification for material breaches. 15 enhancements.