Operate detection and analysis per NIST SP 800-61 Rev 2 Section 3.2 (Detection and Analysis). Tasks include (a) Attack vectors as taxonomy (External/Removable Media + Attrition + Web + Email + Improper Usage + Loss or Theft of Equipment + Other) for categorisation per Section 3.2.1, (b) Signs of an Incident: precursors and indicators monitored across SIEM + IDS/IPS + antimalware + log management + file integrity monitoring + third-party monitoring services + public information sources + people-reported indicators per Section 3.2.2, (c) Sources of Precursors and Indicators inventory per Section 3.2.3, (d) Incident Analysis including network and system profiling + understand normal behaviour + create log retention policy + perform event correlation + keep all host clocks synchronised + use a knowledge base + use Internet search engines for research + run packet sniffers to collect additional data + filter the data + seek assistance from others per Section 3.2.4, (e) Incident Documentation: status + summary + indicators + related incidents + actions taken + chain of custody + impact assessment + contact information + list of evidence gathered + comments from handlers + next steps per Section 3.2.5, (f) Incident Prioritisation by functional impact + information impact + recoverability effort per Section 3.2.6 with predefined matrices, (g) Incident Notification: who to notify with what content and via what channel per Section 3.2.7.
What else in your programme already covers this
This control maps to 111 controls across 46 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
3.3.1 SAD is not stored after authorization, even if encrypted. All sensitive authentication data received is rendered unrecoverable upon completion of the authorization process
3.3.1 SAD is not stored after authorization, even if encrypted. All sensitive authentication data received is rendered unrecoverable upon completion of the authorization process