Security Operations and Incident Response

NIST (the U.S. National Institute of Standards and Technology) Special Publication 800-61 Revision 3 (SP 800-61r3) defines an incident as an occurrence that actually or imminently jeopardizes, without lawful authority, the integrity, confidentiality or availability of information or an information system, or that violates or imminently threatens to violate law, security policies, security procedures or acceptable use policies (SP 800-61r3, section 1). SP 800-61r3 builds its incident response model on the six Functions of the Cybersecurity Framework (CSF) 2.0 in three parts: a preparation layer (Govern, Identify and Protect) that prevents some incidents and prepares for the rest, an incident response layer (Detect, Respond and Recover) that discovers, manages, prioritizes, contains, eradicates and recovers from incidents, and Improvement (a category inside Identify) that collects lessons from every activity and feeds them back into all of them (SP 800-61r3, section 2.1). NIST's incident response layer is wider than the page titled Understand Incident Response, because it also includes Detect, which the security operations page covers.

This domain (17.3% of the exam) follows the CC exam outline through five objectives, starting in the preparation layer with objective 5.1, Understand data security (Protect), where classification decides how much protection information needs and labeling, masking, media sanitization and encryption deliver that protection. Objective 5.2, Understand security operations, is the Detect part of the incident response layer: events are logged, alerts are analyzed, and triage decides whether an alert is an incident and how urgent it is, with threat intelligence and threat frameworks such as MITRE ATT&CK (a knowledge base of attacker behavior) supplying context. An incident is declared when activity meets the defined incident criteria (SP 800-61r3, DE.AE-08). Objective 5.3, Understand Incident Response (IR), covers Respond and Recover, where the incident response plan designates who is responsible for the response (NIST Special Publication 800-53 Revision 5 (SP 800-53r5), control IR-8). Incident records and evidence are protected; containment, eradication and recovery are separate goals. Objective 5.3 also lists IR exercises, such as tabletops, which rehearse the plan; SP 800-61r3 places IR exercises and tests under Improvement (ID.IM-02, an Improvement Category outcome within the Identify Function) (SP 800-61r3, ID.IM-02). Objective 5.4, Understand asset protection, returns to the preparation layer (Identify and Protect) by keeping an inventory of every asset across its life and each system in an approved configuration through change management, and objective 5.5, Understand security testing, is Improvement at work, testing the defenses themselves through red, blue and purple teaming, application testing and physical penetration tests.

Across all five pages, the ability to act never grants the authority to act. An incident response policy usually names which roles have the authority to confiscate, disconnect or shut down technology assets (SP 800-61r3, section 2.3). Likewise, change management decides who approves a change that administrator rights merely make possible, and the rules of engagement decide what a tester may touch. The second instinct is to verify before concluding: an alert is a question for triage, a scanner finding is a suspected weakness to validate, a restored system is checked before it returns to service, and a fix is evaluated before it counts as done.