FFIEC IT Examination Handbook IS-III.C: III.C Incident Identification and Assessment (Information Security)

Management has a process to identify indicators of compromise from external and internal sources, hunt teams and technology (threat intelligence feeds, intrusion detection and prevention, endpoint visibility, DLP, log correlation, file integrity, malware detection, network behaviour analysis and analytics), report them rapidly for investigation, analyse the associated events, classify them, escalate consistently with the classification, and report internally and externally as appropriate.