Executive Summary
| Severity-weighted score | 0.0% |
|---|---|
| Total controls | 84 |
| Met | 0 |
| Partial | 0 |
| Gap | 84 |
Key Gaps
DFIR-005Preparation readiness control 05 - gap - severity 5 - missing evidence 3DFIR-010Preparation readiness control 10 - gap - severity 5 - missing evidence 3DFIR-019DetectionAnalysis readiness control 05 - gap - severity 5 - missing evidence 3DFIR-024DetectionAnalysis readiness control 10 - gap - severity 5 - missing evidence 3DFIR-033Containment readiness control 05 - gap - severity 5 - missing evidence 3DFIR-038Containment readiness control 10 - gap - severity 5 - missing evidence 3DFIR-047Eradication readiness control 05 - gap - severity 5 - missing evidence 3DFIR-052Eradication readiness control 10 - gap - severity 5 - missing evidence 3DFIR-061Recovery readiness control 05 - gap - severity 5 - missing evidence 3DFIR-066Recovery readiness control 10 - gap - severity 5 - missing evidence 3DFIR-075PostIncident readiness control 05 - gap - severity 5 - missing evidence 3DFIR-080PostIncident readiness control 10 - gap - severity 5 - missing evidence 3
Full Controls Table
| control_id | title | objective | evidence expectations | status | severity | evidence_count |
|---|---|---|---|---|---|---|
DFIR-001 | Preparation readiness control 01 | Ensure Preparation procedures are documented, exercised, and reproducible for incident response readiness. | Policy/procedure artifact showing ownership and cadence for Preparation.; Operational records (logs, tickets, reports, or runbooks) demonstrating Preparation execution.; Review evidence with remediation tracking for Preparation exceptions. | gap | 1 | 0 |
DFIR-002 | Preparation readiness control 02 | Ensure Preparation procedures are documented, exercised, and reproducible for incident response readiness. | Policy/procedure artifact showing ownership and cadence for Preparation.; Operational records (logs, tickets, reports, or runbooks) demonstrating Preparation execution.; Review evidence with remediation tracking for Preparation exceptions. | gap | 2 | 0 |
DFIR-003 | Preparation readiness control 03 | Ensure Preparation procedures are documented, exercised, and reproducible for incident response readiness. | Policy/procedure artifact showing ownership and cadence for Preparation.; Operational records (logs, tickets, reports, or runbooks) demonstrating Preparation execution.; Review evidence with remediation tracking for Preparation exceptions. | gap | 3 | 0 |
DFIR-004 | Preparation readiness control 04 | Ensure Preparation procedures are documented, exercised, and reproducible for incident response readiness. | Policy/procedure artifact showing ownership and cadence for Preparation.; Operational records (logs, tickets, reports, or runbooks) demonstrating Preparation execution.; Review evidence with remediation tracking for Preparation exceptions. | gap | 4 | 0 |
DFIR-005 | Preparation readiness control 05 | Ensure Preparation procedures are documented, exercised, and reproducible for incident response readiness. | Policy/procedure artifact showing ownership and cadence for Preparation.; Operational records (logs, tickets, reports, or runbooks) demonstrating Preparation execution.; Review evidence with remediation tracking for Preparation exceptions. | gap | 5 | 0 |
DFIR-006 | Preparation readiness control 06 | Ensure Preparation procedures are documented, exercised, and reproducible for incident response readiness. | Policy/procedure artifact showing ownership and cadence for Preparation.; Operational records (logs, tickets, reports, or runbooks) demonstrating Preparation execution.; Review evidence with remediation tracking for Preparation exceptions. | gap | 1 | 0 |
DFIR-007 | Preparation readiness control 07 | Ensure Preparation procedures are documented, exercised, and reproducible for incident response readiness. | Policy/procedure artifact showing ownership and cadence for Preparation.; Operational records (logs, tickets, reports, or runbooks) demonstrating Preparation execution.; Review evidence with remediation tracking for Preparation exceptions. | gap | 2 | 0 |
DFIR-008 | Preparation readiness control 08 | Ensure Preparation procedures are documented, exercised, and reproducible for incident response readiness. | Policy/procedure artifact showing ownership and cadence for Preparation.; Operational records (logs, tickets, reports, or runbooks) demonstrating Preparation execution.; Review evidence with remediation tracking for Preparation exceptions. | gap | 3 | 0 |
DFIR-009 | Preparation readiness control 09 | Ensure Preparation procedures are documented, exercised, and reproducible for incident response readiness. | Policy/procedure artifact showing ownership and cadence for Preparation.; Operational records (logs, tickets, reports, or runbooks) demonstrating Preparation execution.; Review evidence with remediation tracking for Preparation exceptions. | gap | 4 | 0 |
DFIR-010 | Preparation readiness control 10 | Ensure Preparation procedures are documented, exercised, and reproducible for incident response readiness. | Policy/procedure artifact showing ownership and cadence for Preparation.; Operational records (logs, tickets, reports, or runbooks) demonstrating Preparation execution.; Review evidence with remediation tracking for Preparation exceptions. | gap | 5 | 0 |
DFIR-011 | Preparation readiness control 11 | Ensure Preparation procedures are documented, exercised, and reproducible for incident response readiness. | Policy/procedure artifact showing ownership and cadence for Preparation.; Operational records (logs, tickets, reports, or runbooks) demonstrating Preparation execution.; Review evidence with remediation tracking for Preparation exceptions. | gap | 1 | 0 |
DFIR-012 | Preparation readiness control 12 | Ensure Preparation procedures are documented, exercised, and reproducible for incident response readiness. | Policy/procedure artifact showing ownership and cadence for Preparation.; Operational records (logs, tickets, reports, or runbooks) demonstrating Preparation execution.; Review evidence with remediation tracking for Preparation exceptions. | gap | 2 | 0 |
DFIR-013 | Preparation readiness control 13 | Ensure Preparation procedures are documented, exercised, and reproducible for incident response readiness. | Policy/procedure artifact showing ownership and cadence for Preparation.; Operational records (logs, tickets, reports, or runbooks) demonstrating Preparation execution.; Review evidence with remediation tracking for Preparation exceptions. | gap | 3 | 0 |
DFIR-014 | Preparation readiness control 14 | Ensure Preparation procedures are documented, exercised, and reproducible for incident response readiness. | Policy/procedure artifact showing ownership and cadence for Preparation.; Operational records (logs, tickets, reports, or runbooks) demonstrating Preparation execution.; Review evidence with remediation tracking for Preparation exceptions. | gap | 4 | 0 |
DFIR-015 | DetectionAnalysis readiness control 01 | Ensure DetectionAnalysis procedures are documented, exercised, and reproducible for incident response readiness. | Policy/procedure artifact showing ownership and cadence for DetectionAnalysis.; Operational records (logs, tickets, reports, or runbooks) demonstrating DetectionAnalysis execution.; Review evidence with remediation tracking for DetectionAnalysis exceptions. | gap | 1 | 0 |
DFIR-016 | DetectionAnalysis readiness control 02 | Ensure DetectionAnalysis procedures are documented, exercised, and reproducible for incident response readiness. | Policy/procedure artifact showing ownership and cadence for DetectionAnalysis.; Operational records (logs, tickets, reports, or runbooks) demonstrating DetectionAnalysis execution.; Review evidence with remediation tracking for DetectionAnalysis exceptions. | gap | 2 | 0 |
DFIR-017 | DetectionAnalysis readiness control 03 | Ensure DetectionAnalysis procedures are documented, exercised, and reproducible for incident response readiness. | Policy/procedure artifact showing ownership and cadence for DetectionAnalysis.; Operational records (logs, tickets, reports, or runbooks) demonstrating DetectionAnalysis execution.; Review evidence with remediation tracking for DetectionAnalysis exceptions. | gap | 3 | 0 |
DFIR-018 | DetectionAnalysis readiness control 04 | Ensure DetectionAnalysis procedures are documented, exercised, and reproducible for incident response readiness. | Policy/procedure artifact showing ownership and cadence for DetectionAnalysis.; Operational records (logs, tickets, reports, or runbooks) demonstrating DetectionAnalysis execution.; Review evidence with remediation tracking for DetectionAnalysis exceptions. | gap | 4 | 0 |
DFIR-019 | DetectionAnalysis readiness control 05 | Ensure DetectionAnalysis procedures are documented, exercised, and reproducible for incident response readiness. | Policy/procedure artifact showing ownership and cadence for DetectionAnalysis.; Operational records (logs, tickets, reports, or runbooks) demonstrating DetectionAnalysis execution.; Review evidence with remediation tracking for DetectionAnalysis exceptions. | gap | 5 | 0 |
DFIR-020 | DetectionAnalysis readiness control 06 | Ensure DetectionAnalysis procedures are documented, exercised, and reproducible for incident response readiness. | Policy/procedure artifact showing ownership and cadence for DetectionAnalysis.; Operational records (logs, tickets, reports, or runbooks) demonstrating DetectionAnalysis execution.; Review evidence with remediation tracking for DetectionAnalysis exceptions. | gap | 1 | 0 |
DFIR-021 | DetectionAnalysis readiness control 07 | Ensure DetectionAnalysis procedures are documented, exercised, and reproducible for incident response readiness. | Policy/procedure artifact showing ownership and cadence for DetectionAnalysis.; Operational records (logs, tickets, reports, or runbooks) demonstrating DetectionAnalysis execution.; Review evidence with remediation tracking for DetectionAnalysis exceptions. | gap | 2 | 0 |
DFIR-022 | DetectionAnalysis readiness control 08 | Ensure DetectionAnalysis procedures are documented, exercised, and reproducible for incident response readiness. | Policy/procedure artifact showing ownership and cadence for DetectionAnalysis.; Operational records (logs, tickets, reports, or runbooks) demonstrating DetectionAnalysis execution.; Review evidence with remediation tracking for DetectionAnalysis exceptions. | gap | 3 | 0 |
DFIR-023 | DetectionAnalysis readiness control 09 | Ensure DetectionAnalysis procedures are documented, exercised, and reproducible for incident response readiness. | Policy/procedure artifact showing ownership and cadence for DetectionAnalysis.; Operational records (logs, tickets, reports, or runbooks) demonstrating DetectionAnalysis execution.; Review evidence with remediation tracking for DetectionAnalysis exceptions. | gap | 4 | 0 |
DFIR-024 | DetectionAnalysis readiness control 10 | Ensure DetectionAnalysis procedures are documented, exercised, and reproducible for incident response readiness. | Policy/procedure artifact showing ownership and cadence for DetectionAnalysis.; Operational records (logs, tickets, reports, or runbooks) demonstrating DetectionAnalysis execution.; Review evidence with remediation tracking for DetectionAnalysis exceptions. | gap | 5 | 0 |
DFIR-025 | DetectionAnalysis readiness control 11 | Ensure DetectionAnalysis procedures are documented, exercised, and reproducible for incident response readiness. | Policy/procedure artifact showing ownership and cadence for DetectionAnalysis.; Operational records (logs, tickets, reports, or runbooks) demonstrating DetectionAnalysis execution.; Review evidence with remediation tracking for DetectionAnalysis exceptions. | gap | 1 | 0 |
DFIR-026 | DetectionAnalysis readiness control 12 | Ensure DetectionAnalysis procedures are documented, exercised, and reproducible for incident response readiness. | Policy/procedure artifact showing ownership and cadence for DetectionAnalysis.; Operational records (logs, tickets, reports, or runbooks) demonstrating DetectionAnalysis execution.; Review evidence with remediation tracking for DetectionAnalysis exceptions. | gap | 2 | 0 |
DFIR-027 | DetectionAnalysis readiness control 13 | Ensure DetectionAnalysis procedures are documented, exercised, and reproducible for incident response readiness. | Policy/procedure artifact showing ownership and cadence for DetectionAnalysis.; Operational records (logs, tickets, reports, or runbooks) demonstrating DetectionAnalysis execution.; Review evidence with remediation tracking for DetectionAnalysis exceptions. | gap | 3 | 0 |
DFIR-028 | DetectionAnalysis readiness control 14 | Ensure DetectionAnalysis procedures are documented, exercised, and reproducible for incident response readiness. | Policy/procedure artifact showing ownership and cadence for DetectionAnalysis.; Operational records (logs, tickets, reports, or runbooks) demonstrating DetectionAnalysis execution.; Review evidence with remediation tracking for DetectionAnalysis exceptions. | gap | 4 | 0 |
DFIR-029 | Containment readiness control 01 | Ensure Containment procedures are documented, exercised, and reproducible for incident response readiness. | Policy/procedure artifact showing ownership and cadence for Containment.; Operational records (logs, tickets, reports, or runbooks) demonstrating Containment execution.; Review evidence with remediation tracking for Containment exceptions. | gap | 1 | 0 |
DFIR-030 | Containment readiness control 02 | Ensure Containment procedures are documented, exercised, and reproducible for incident response readiness. | Policy/procedure artifact showing ownership and cadence for Containment.; Operational records (logs, tickets, reports, or runbooks) demonstrating Containment execution.; Review evidence with remediation tracking for Containment exceptions. | gap | 2 | 0 |
DFIR-031 | Containment readiness control 03 | Ensure Containment procedures are documented, exercised, and reproducible for incident response readiness. | Policy/procedure artifact showing ownership and cadence for Containment.; Operational records (logs, tickets, reports, or runbooks) demonstrating Containment execution.; Review evidence with remediation tracking for Containment exceptions. | gap | 3 | 0 |
DFIR-032 | Containment readiness control 04 | Ensure Containment procedures are documented, exercised, and reproducible for incident response readiness. | Policy/procedure artifact showing ownership and cadence for Containment.; Operational records (logs, tickets, reports, or runbooks) demonstrating Containment execution.; Review evidence with remediation tracking for Containment exceptions. | gap | 4 | 0 |
DFIR-033 | Containment readiness control 05 | Ensure Containment procedures are documented, exercised, and reproducible for incident response readiness. | Policy/procedure artifact showing ownership and cadence for Containment.; Operational records (logs, tickets, reports, or runbooks) demonstrating Containment execution.; Review evidence with remediation tracking for Containment exceptions. | gap | 5 | 0 |
DFIR-034 | Containment readiness control 06 | Ensure Containment procedures are documented, exercised, and reproducible for incident response readiness. | Policy/procedure artifact showing ownership and cadence for Containment.; Operational records (logs, tickets, reports, or runbooks) demonstrating Containment execution.; Review evidence with remediation tracking for Containment exceptions. | gap | 1 | 0 |
DFIR-035 | Containment readiness control 07 | Ensure Containment procedures are documented, exercised, and reproducible for incident response readiness. | Policy/procedure artifact showing ownership and cadence for Containment.; Operational records (logs, tickets, reports, or runbooks) demonstrating Containment execution.; Review evidence with remediation tracking for Containment exceptions. | gap | 2 | 0 |
DFIR-036 | Containment readiness control 08 | Ensure Containment procedures are documented, exercised, and reproducible for incident response readiness. | Policy/procedure artifact showing ownership and cadence for Containment.; Operational records (logs, tickets, reports, or runbooks) demonstrating Containment execution.; Review evidence with remediation tracking for Containment exceptions. | gap | 3 | 0 |
DFIR-037 | Containment readiness control 09 | Ensure Containment procedures are documented, exercised, and reproducible for incident response readiness. | Policy/procedure artifact showing ownership and cadence for Containment.; Operational records (logs, tickets, reports, or runbooks) demonstrating Containment execution.; Review evidence with remediation tracking for Containment exceptions. | gap | 4 | 0 |
DFIR-038 | Containment readiness control 10 | Ensure Containment procedures are documented, exercised, and reproducible for incident response readiness. | Policy/procedure artifact showing ownership and cadence for Containment.; Operational records (logs, tickets, reports, or runbooks) demonstrating Containment execution.; Review evidence with remediation tracking for Containment exceptions. | gap | 5 | 0 |
DFIR-039 | Containment readiness control 11 | Ensure Containment procedures are documented, exercised, and reproducible for incident response readiness. | Policy/procedure artifact showing ownership and cadence for Containment.; Operational records (logs, tickets, reports, or runbooks) demonstrating Containment execution.; Review evidence with remediation tracking for Containment exceptions. | gap | 1 | 0 |
DFIR-040 | Containment readiness control 12 | Ensure Containment procedures are documented, exercised, and reproducible for incident response readiness. | Policy/procedure artifact showing ownership and cadence for Containment.; Operational records (logs, tickets, reports, or runbooks) demonstrating Containment execution.; Review evidence with remediation tracking for Containment exceptions. | gap | 2 | 0 |
DFIR-041 | Containment readiness control 13 | Ensure Containment procedures are documented, exercised, and reproducible for incident response readiness. | Policy/procedure artifact showing ownership and cadence for Containment.; Operational records (logs, tickets, reports, or runbooks) demonstrating Containment execution.; Review evidence with remediation tracking for Containment exceptions. | gap | 3 | 0 |
DFIR-042 | Containment readiness control 14 | Ensure Containment procedures are documented, exercised, and reproducible for incident response readiness. | Policy/procedure artifact showing ownership and cadence for Containment.; Operational records (logs, tickets, reports, or runbooks) demonstrating Containment execution.; Review evidence with remediation tracking for Containment exceptions. | gap | 4 | 0 |
DFIR-043 | Eradication readiness control 01 | Ensure Eradication procedures are documented, exercised, and reproducible for incident response readiness. | Policy/procedure artifact showing ownership and cadence for Eradication.; Operational records (logs, tickets, reports, or runbooks) demonstrating Eradication execution.; Review evidence with remediation tracking for Eradication exceptions. | gap | 1 | 0 |
DFIR-044 | Eradication readiness control 02 | Ensure Eradication procedures are documented, exercised, and reproducible for incident response readiness. | Policy/procedure artifact showing ownership and cadence for Eradication.; Operational records (logs, tickets, reports, or runbooks) demonstrating Eradication execution.; Review evidence with remediation tracking for Eradication exceptions. | gap | 2 | 0 |
DFIR-045 | Eradication readiness control 03 | Ensure Eradication procedures are documented, exercised, and reproducible for incident response readiness. | Policy/procedure artifact showing ownership and cadence for Eradication.; Operational records (logs, tickets, reports, or runbooks) demonstrating Eradication execution.; Review evidence with remediation tracking for Eradication exceptions. | gap | 3 | 0 |
DFIR-046 | Eradication readiness control 04 | Ensure Eradication procedures are documented, exercised, and reproducible for incident response readiness. | Policy/procedure artifact showing ownership and cadence for Eradication.; Operational records (logs, tickets, reports, or runbooks) demonstrating Eradication execution.; Review evidence with remediation tracking for Eradication exceptions. | gap | 4 | 0 |
DFIR-047 | Eradication readiness control 05 | Ensure Eradication procedures are documented, exercised, and reproducible for incident response readiness. | Policy/procedure artifact showing ownership and cadence for Eradication.; Operational records (logs, tickets, reports, or runbooks) demonstrating Eradication execution.; Review evidence with remediation tracking for Eradication exceptions. | gap | 5 | 0 |
DFIR-048 | Eradication readiness control 06 | Ensure Eradication procedures are documented, exercised, and reproducible for incident response readiness. | Policy/procedure artifact showing ownership and cadence for Eradication.; Operational records (logs, tickets, reports, or runbooks) demonstrating Eradication execution.; Review evidence with remediation tracking for Eradication exceptions. | gap | 1 | 0 |
DFIR-049 | Eradication readiness control 07 | Ensure Eradication procedures are documented, exercised, and reproducible for incident response readiness. | Policy/procedure artifact showing ownership and cadence for Eradication.; Operational records (logs, tickets, reports, or runbooks) demonstrating Eradication execution.; Review evidence with remediation tracking for Eradication exceptions. | gap | 2 | 0 |
DFIR-050 | Eradication readiness control 08 | Ensure Eradication procedures are documented, exercised, and reproducible for incident response readiness. | Policy/procedure artifact showing ownership and cadence for Eradication.; Operational records (logs, tickets, reports, or runbooks) demonstrating Eradication execution.; Review evidence with remediation tracking for Eradication exceptions. | gap | 3 | 0 |
DFIR-051 | Eradication readiness control 09 | Ensure Eradication procedures are documented, exercised, and reproducible for incident response readiness. | Policy/procedure artifact showing ownership and cadence for Eradication.; Operational records (logs, tickets, reports, or runbooks) demonstrating Eradication execution.; Review evidence with remediation tracking for Eradication exceptions. | gap | 4 | 0 |
DFIR-052 | Eradication readiness control 10 | Ensure Eradication procedures are documented, exercised, and reproducible for incident response readiness. | Policy/procedure artifact showing ownership and cadence for Eradication.; Operational records (logs, tickets, reports, or runbooks) demonstrating Eradication execution.; Review evidence with remediation tracking for Eradication exceptions. | gap | 5 | 0 |
DFIR-053 | Eradication readiness control 11 | Ensure Eradication procedures are documented, exercised, and reproducible for incident response readiness. | Policy/procedure artifact showing ownership and cadence for Eradication.; Operational records (logs, tickets, reports, or runbooks) demonstrating Eradication execution.; Review evidence with remediation tracking for Eradication exceptions. | gap | 1 | 0 |
DFIR-054 | Eradication readiness control 12 | Ensure Eradication procedures are documented, exercised, and reproducible for incident response readiness. | Policy/procedure artifact showing ownership and cadence for Eradication.; Operational records (logs, tickets, reports, or runbooks) demonstrating Eradication execution.; Review evidence with remediation tracking for Eradication exceptions. | gap | 2 | 0 |
DFIR-055 | Eradication readiness control 13 | Ensure Eradication procedures are documented, exercised, and reproducible for incident response readiness. | Policy/procedure artifact showing ownership and cadence for Eradication.; Operational records (logs, tickets, reports, or runbooks) demonstrating Eradication execution.; Review evidence with remediation tracking for Eradication exceptions. | gap | 3 | 0 |
DFIR-056 | Eradication readiness control 14 | Ensure Eradication procedures are documented, exercised, and reproducible for incident response readiness. | Policy/procedure artifact showing ownership and cadence for Eradication.; Operational records (logs, tickets, reports, or runbooks) demonstrating Eradication execution.; Review evidence with remediation tracking for Eradication exceptions. | gap | 4 | 0 |
DFIR-057 | Recovery readiness control 01 | Ensure Recovery procedures are documented, exercised, and reproducible for incident response readiness. | Policy/procedure artifact showing ownership and cadence for Recovery.; Operational records (logs, tickets, reports, or runbooks) demonstrating Recovery execution.; Review evidence with remediation tracking for Recovery exceptions. | gap | 1 | 0 |
DFIR-058 | Recovery readiness control 02 | Ensure Recovery procedures are documented, exercised, and reproducible for incident response readiness. | Policy/procedure artifact showing ownership and cadence for Recovery.; Operational records (logs, tickets, reports, or runbooks) demonstrating Recovery execution.; Review evidence with remediation tracking for Recovery exceptions. | gap | 2 | 0 |
DFIR-059 | Recovery readiness control 03 | Ensure Recovery procedures are documented, exercised, and reproducible for incident response readiness. | Policy/procedure artifact showing ownership and cadence for Recovery.; Operational records (logs, tickets, reports, or runbooks) demonstrating Recovery execution.; Review evidence with remediation tracking for Recovery exceptions. | gap | 3 | 0 |
DFIR-060 | Recovery readiness control 04 | Ensure Recovery procedures are documented, exercised, and reproducible for incident response readiness. | Policy/procedure artifact showing ownership and cadence for Recovery.; Operational records (logs, tickets, reports, or runbooks) demonstrating Recovery execution.; Review evidence with remediation tracking for Recovery exceptions. | gap | 4 | 0 |
DFIR-061 | Recovery readiness control 05 | Ensure Recovery procedures are documented, exercised, and reproducible for incident response readiness. | Policy/procedure artifact showing ownership and cadence for Recovery.; Operational records (logs, tickets, reports, or runbooks) demonstrating Recovery execution.; Review evidence with remediation tracking for Recovery exceptions. | gap | 5 | 0 |
DFIR-062 | Recovery readiness control 06 | Ensure Recovery procedures are documented, exercised, and reproducible for incident response readiness. | Policy/procedure artifact showing ownership and cadence for Recovery.; Operational records (logs, tickets, reports, or runbooks) demonstrating Recovery execution.; Review evidence with remediation tracking for Recovery exceptions. | gap | 1 | 0 |
DFIR-063 | Recovery readiness control 07 | Ensure Recovery procedures are documented, exercised, and reproducible for incident response readiness. | Policy/procedure artifact showing ownership and cadence for Recovery.; Operational records (logs, tickets, reports, or runbooks) demonstrating Recovery execution.; Review evidence with remediation tracking for Recovery exceptions. | gap | 2 | 0 |
DFIR-064 | Recovery readiness control 08 | Ensure Recovery procedures are documented, exercised, and reproducible for incident response readiness. | Policy/procedure artifact showing ownership and cadence for Recovery.; Operational records (logs, tickets, reports, or runbooks) demonstrating Recovery execution.; Review evidence with remediation tracking for Recovery exceptions. | gap | 3 | 0 |
DFIR-065 | Recovery readiness control 09 | Ensure Recovery procedures are documented, exercised, and reproducible for incident response readiness. | Policy/procedure artifact showing ownership and cadence for Recovery.; Operational records (logs, tickets, reports, or runbooks) demonstrating Recovery execution.; Review evidence with remediation tracking for Recovery exceptions. | gap | 4 | 0 |
DFIR-066 | Recovery readiness control 10 | Ensure Recovery procedures are documented, exercised, and reproducible for incident response readiness. | Policy/procedure artifact showing ownership and cadence for Recovery.; Operational records (logs, tickets, reports, or runbooks) demonstrating Recovery execution.; Review evidence with remediation tracking for Recovery exceptions. | gap | 5 | 0 |
DFIR-067 | Recovery readiness control 11 | Ensure Recovery procedures are documented, exercised, and reproducible for incident response readiness. | Policy/procedure artifact showing ownership and cadence for Recovery.; Operational records (logs, tickets, reports, or runbooks) demonstrating Recovery execution.; Review evidence with remediation tracking for Recovery exceptions. | gap | 1 | 0 |
DFIR-068 | Recovery readiness control 12 | Ensure Recovery procedures are documented, exercised, and reproducible for incident response readiness. | Policy/procedure artifact showing ownership and cadence for Recovery.; Operational records (logs, tickets, reports, or runbooks) demonstrating Recovery execution.; Review evidence with remediation tracking for Recovery exceptions. | gap | 2 | 0 |
DFIR-069 | Recovery readiness control 13 | Ensure Recovery procedures are documented, exercised, and reproducible for incident response readiness. | Policy/procedure artifact showing ownership and cadence for Recovery.; Operational records (logs, tickets, reports, or runbooks) demonstrating Recovery execution.; Review evidence with remediation tracking for Recovery exceptions. | gap | 3 | 0 |
DFIR-070 | Recovery readiness control 14 | Ensure Recovery procedures are documented, exercised, and reproducible for incident response readiness. | Policy/procedure artifact showing ownership and cadence for Recovery.; Operational records (logs, tickets, reports, or runbooks) demonstrating Recovery execution.; Review evidence with remediation tracking for Recovery exceptions. | gap | 4 | 0 |
DFIR-071 | PostIncident readiness control 01 | Ensure PostIncident procedures are documented, exercised, and reproducible for incident response readiness. | Policy/procedure artifact showing ownership and cadence for PostIncident.; Operational records (logs, tickets, reports, or runbooks) demonstrating PostIncident execution.; Review evidence with remediation tracking for PostIncident exceptions. | gap | 1 | 0 |
DFIR-072 | PostIncident readiness control 02 | Ensure PostIncident procedures are documented, exercised, and reproducible for incident response readiness. | Policy/procedure artifact showing ownership and cadence for PostIncident.; Operational records (logs, tickets, reports, or runbooks) demonstrating PostIncident execution.; Review evidence with remediation tracking for PostIncident exceptions. | gap | 2 | 0 |
DFIR-073 | PostIncident readiness control 03 | Ensure PostIncident procedures are documented, exercised, and reproducible for incident response readiness. | Policy/procedure artifact showing ownership and cadence for PostIncident.; Operational records (logs, tickets, reports, or runbooks) demonstrating PostIncident execution.; Review evidence with remediation tracking for PostIncident exceptions. | gap | 3 | 0 |
DFIR-074 | PostIncident readiness control 04 | Ensure PostIncident procedures are documented, exercised, and reproducible for incident response readiness. | Policy/procedure artifact showing ownership and cadence for PostIncident.; Operational records (logs, tickets, reports, or runbooks) demonstrating PostIncident execution.; Review evidence with remediation tracking for PostIncident exceptions. | gap | 4 | 0 |
DFIR-075 | PostIncident readiness control 05 | Ensure PostIncident procedures are documented, exercised, and reproducible for incident response readiness. | Policy/procedure artifact showing ownership and cadence for PostIncident.; Operational records (logs, tickets, reports, or runbooks) demonstrating PostIncident execution.; Review evidence with remediation tracking for PostIncident exceptions. | gap | 5 | 0 |
DFIR-076 | PostIncident readiness control 06 | Ensure PostIncident procedures are documented, exercised, and reproducible for incident response readiness. | Policy/procedure artifact showing ownership and cadence for PostIncident.; Operational records (logs, tickets, reports, or runbooks) demonstrating PostIncident execution.; Review evidence with remediation tracking for PostIncident exceptions. | gap | 1 | 0 |
DFIR-077 | PostIncident readiness control 07 | Ensure PostIncident procedures are documented, exercised, and reproducible for incident response readiness. | Policy/procedure artifact showing ownership and cadence for PostIncident.; Operational records (logs, tickets, reports, or runbooks) demonstrating PostIncident execution.; Review evidence with remediation tracking for PostIncident exceptions. | gap | 2 | 0 |
DFIR-078 | PostIncident readiness control 08 | Ensure PostIncident procedures are documented, exercised, and reproducible for incident response readiness. | Policy/procedure artifact showing ownership and cadence for PostIncident.; Operational records (logs, tickets, reports, or runbooks) demonstrating PostIncident execution.; Review evidence with remediation tracking for PostIncident exceptions. | gap | 3 | 0 |
DFIR-079 | PostIncident readiness control 09 | Ensure PostIncident procedures are documented, exercised, and reproducible for incident response readiness. | Policy/procedure artifact showing ownership and cadence for PostIncident.; Operational records (logs, tickets, reports, or runbooks) demonstrating PostIncident execution.; Review evidence with remediation tracking for PostIncident exceptions. | gap | 4 | 0 |
DFIR-080 | PostIncident readiness control 10 | Ensure PostIncident procedures are documented, exercised, and reproducible for incident response readiness. | Policy/procedure artifact showing ownership and cadence for PostIncident.; Operational records (logs, tickets, reports, or runbooks) demonstrating PostIncident execution.; Review evidence with remediation tracking for PostIncident exceptions. | gap | 5 | 0 |
DFIR-081 | PostIncident readiness control 11 | Ensure PostIncident procedures are documented, exercised, and reproducible for incident response readiness. | Policy/procedure artifact showing ownership and cadence for PostIncident.; Operational records (logs, tickets, reports, or runbooks) demonstrating PostIncident execution.; Review evidence with remediation tracking for PostIncident exceptions. | gap | 1 | 0 |
DFIR-082 | PostIncident readiness control 12 | Ensure PostIncident procedures are documented, exercised, and reproducible for incident response readiness. | Policy/procedure artifact showing ownership and cadence for PostIncident.; Operational records (logs, tickets, reports, or runbooks) demonstrating PostIncident execution.; Review evidence with remediation tracking for PostIncident exceptions. | gap | 2 | 0 |
DFIR-083 | PostIncident readiness control 13 | Ensure PostIncident procedures are documented, exercised, and reproducible for incident response readiness. | Policy/procedure artifact showing ownership and cadence for PostIncident.; Operational records (logs, tickets, reports, or runbooks) demonstrating PostIncident execution.; Review evidence with remediation tracking for PostIncident exceptions. | gap | 3 | 0 |
DFIR-084 | PostIncident readiness control 14 | Ensure PostIncident procedures are documented, exercised, and reproducible for incident response readiness. | Policy/procedure artifact showing ownership and cadence for PostIncident.; Operational records (logs, tickets, reports, or runbooks) demonstrating PostIncident execution.; Review evidence with remediation tracking for PostIncident exceptions. | gap | 4 | 0 |
Gap Register
| control_id | title | status | severity | evidence_count | missing_evidence | evidence expectations |
|---|---|---|---|---|---|---|
DFIR-001 | Preparation readiness control 01 | gap | 1 | 0 | 3 | Policy/procedure artifact showing ownership and cadence for Preparation.; Operational records (logs, tickets, reports, or runbooks) demonstrating Preparation execution.; Review evidence with remediation tracking for Preparation exceptions. |
DFIR-002 | Preparation readiness control 02 | gap | 2 | 0 | 3 | Policy/procedure artifact showing ownership and cadence for Preparation.; Operational records (logs, tickets, reports, or runbooks) demonstrating Preparation execution.; Review evidence with remediation tracking for Preparation exceptions. |
DFIR-003 | Preparation readiness control 03 | gap | 3 | 0 | 3 | Policy/procedure artifact showing ownership and cadence for Preparation.; Operational records (logs, tickets, reports, or runbooks) demonstrating Preparation execution.; Review evidence with remediation tracking for Preparation exceptions. |
DFIR-004 | Preparation readiness control 04 | gap | 4 | 0 | 3 | Policy/procedure artifact showing ownership and cadence for Preparation.; Operational records (logs, tickets, reports, or runbooks) demonstrating Preparation execution.; Review evidence with remediation tracking for Preparation exceptions. |
DFIR-005 | Preparation readiness control 05 | gap | 5 | 0 | 3 | Policy/procedure artifact showing ownership and cadence for Preparation.; Operational records (logs, tickets, reports, or runbooks) demonstrating Preparation execution.; Review evidence with remediation tracking for Preparation exceptions. |
DFIR-006 | Preparation readiness control 06 | gap | 1 | 0 | 3 | Policy/procedure artifact showing ownership and cadence for Preparation.; Operational records (logs, tickets, reports, or runbooks) demonstrating Preparation execution.; Review evidence with remediation tracking for Preparation exceptions. |
DFIR-007 | Preparation readiness control 07 | gap | 2 | 0 | 3 | Policy/procedure artifact showing ownership and cadence for Preparation.; Operational records (logs, tickets, reports, or runbooks) demonstrating Preparation execution.; Review evidence with remediation tracking for Preparation exceptions. |
DFIR-008 | Preparation readiness control 08 | gap | 3 | 0 | 3 | Policy/procedure artifact showing ownership and cadence for Preparation.; Operational records (logs, tickets, reports, or runbooks) demonstrating Preparation execution.; Review evidence with remediation tracking for Preparation exceptions. |
DFIR-009 | Preparation readiness control 09 | gap | 4 | 0 | 3 | Policy/procedure artifact showing ownership and cadence for Preparation.; Operational records (logs, tickets, reports, or runbooks) demonstrating Preparation execution.; Review evidence with remediation tracking for Preparation exceptions. |
DFIR-010 | Preparation readiness control 10 | gap | 5 | 0 | 3 | Policy/procedure artifact showing ownership and cadence for Preparation.; Operational records (logs, tickets, reports, or runbooks) demonstrating Preparation execution.; Review evidence with remediation tracking for Preparation exceptions. |
DFIR-011 | Preparation readiness control 11 | gap | 1 | 0 | 3 | Policy/procedure artifact showing ownership and cadence for Preparation.; Operational records (logs, tickets, reports, or runbooks) demonstrating Preparation execution.; Review evidence with remediation tracking for Preparation exceptions. |
DFIR-012 | Preparation readiness control 12 | gap | 2 | 0 | 3 | Policy/procedure artifact showing ownership and cadence for Preparation.; Operational records (logs, tickets, reports, or runbooks) demonstrating Preparation execution.; Review evidence with remediation tracking for Preparation exceptions. |
DFIR-013 | Preparation readiness control 13 | gap | 3 | 0 | 3 | Policy/procedure artifact showing ownership and cadence for Preparation.; Operational records (logs, tickets, reports, or runbooks) demonstrating Preparation execution.; Review evidence with remediation tracking for Preparation exceptions. |
DFIR-014 | Preparation readiness control 14 | gap | 4 | 0 | 3 | Policy/procedure artifact showing ownership and cadence for Preparation.; Operational records (logs, tickets, reports, or runbooks) demonstrating Preparation execution.; Review evidence with remediation tracking for Preparation exceptions. |
DFIR-015 | DetectionAnalysis readiness control 01 | gap | 1 | 0 | 3 | Policy/procedure artifact showing ownership and cadence for DetectionAnalysis.; Operational records (logs, tickets, reports, or runbooks) demonstrating DetectionAnalysis execution.; Review evidence with remediation tracking for DetectionAnalysis exceptions. |
DFIR-016 | DetectionAnalysis readiness control 02 | gap | 2 | 0 | 3 | Policy/procedure artifact showing ownership and cadence for DetectionAnalysis.; Operational records (logs, tickets, reports, or runbooks) demonstrating DetectionAnalysis execution.; Review evidence with remediation tracking for DetectionAnalysis exceptions. |
DFIR-017 | DetectionAnalysis readiness control 03 | gap | 3 | 0 | 3 | Policy/procedure artifact showing ownership and cadence for DetectionAnalysis.; Operational records (logs, tickets, reports, or runbooks) demonstrating DetectionAnalysis execution.; Review evidence with remediation tracking for DetectionAnalysis exceptions. |
DFIR-018 | DetectionAnalysis readiness control 04 | gap | 4 | 0 | 3 | Policy/procedure artifact showing ownership and cadence for DetectionAnalysis.; Operational records (logs, tickets, reports, or runbooks) demonstrating DetectionAnalysis execution.; Review evidence with remediation tracking for DetectionAnalysis exceptions. |
DFIR-019 | DetectionAnalysis readiness control 05 | gap | 5 | 0 | 3 | Policy/procedure artifact showing ownership and cadence for DetectionAnalysis.; Operational records (logs, tickets, reports, or runbooks) demonstrating DetectionAnalysis execution.; Review evidence with remediation tracking for DetectionAnalysis exceptions. |
DFIR-020 | DetectionAnalysis readiness control 06 | gap | 1 | 0 | 3 | Policy/procedure artifact showing ownership and cadence for DetectionAnalysis.; Operational records (logs, tickets, reports, or runbooks) demonstrating DetectionAnalysis execution.; Review evidence with remediation tracking for DetectionAnalysis exceptions. |
DFIR-021 | DetectionAnalysis readiness control 07 | gap | 2 | 0 | 3 | Policy/procedure artifact showing ownership and cadence for DetectionAnalysis.; Operational records (logs, tickets, reports, or runbooks) demonstrating DetectionAnalysis execution.; Review evidence with remediation tracking for DetectionAnalysis exceptions. |
DFIR-022 | DetectionAnalysis readiness control 08 | gap | 3 | 0 | 3 | Policy/procedure artifact showing ownership and cadence for DetectionAnalysis.; Operational records (logs, tickets, reports, or runbooks) demonstrating DetectionAnalysis execution.; Review evidence with remediation tracking for DetectionAnalysis exceptions. |
DFIR-023 | DetectionAnalysis readiness control 09 | gap | 4 | 0 | 3 | Policy/procedure artifact showing ownership and cadence for DetectionAnalysis.; Operational records (logs, tickets, reports, or runbooks) demonstrating DetectionAnalysis execution.; Review evidence with remediation tracking for DetectionAnalysis exceptions. |
DFIR-024 | DetectionAnalysis readiness control 10 | gap | 5 | 0 | 3 | Policy/procedure artifact showing ownership and cadence for DetectionAnalysis.; Operational records (logs, tickets, reports, or runbooks) demonstrating DetectionAnalysis execution.; Review evidence with remediation tracking for DetectionAnalysis exceptions. |
DFIR-025 | DetectionAnalysis readiness control 11 | gap | 1 | 0 | 3 | Policy/procedure artifact showing ownership and cadence for DetectionAnalysis.; Operational records (logs, tickets, reports, or runbooks) demonstrating DetectionAnalysis execution.; Review evidence with remediation tracking for DetectionAnalysis exceptions. |
DFIR-026 | DetectionAnalysis readiness control 12 | gap | 2 | 0 | 3 | Policy/procedure artifact showing ownership and cadence for DetectionAnalysis.; Operational records (logs, tickets, reports, or runbooks) demonstrating DetectionAnalysis execution.; Review evidence with remediation tracking for DetectionAnalysis exceptions. |
DFIR-027 | DetectionAnalysis readiness control 13 | gap | 3 | 0 | 3 | Policy/procedure artifact showing ownership and cadence for DetectionAnalysis.; Operational records (logs, tickets, reports, or runbooks) demonstrating DetectionAnalysis execution.; Review evidence with remediation tracking for DetectionAnalysis exceptions. |
DFIR-028 | DetectionAnalysis readiness control 14 | gap | 4 | 0 | 3 | Policy/procedure artifact showing ownership and cadence for DetectionAnalysis.; Operational records (logs, tickets, reports, or runbooks) demonstrating DetectionAnalysis execution.; Review evidence with remediation tracking for DetectionAnalysis exceptions. |
DFIR-029 | Containment readiness control 01 | gap | 1 | 0 | 3 | Policy/procedure artifact showing ownership and cadence for Containment.; Operational records (logs, tickets, reports, or runbooks) demonstrating Containment execution.; Review evidence with remediation tracking for Containment exceptions. |
DFIR-030 | Containment readiness control 02 | gap | 2 | 0 | 3 | Policy/procedure artifact showing ownership and cadence for Containment.; Operational records (logs, tickets, reports, or runbooks) demonstrating Containment execution.; Review evidence with remediation tracking for Containment exceptions. |
DFIR-031 | Containment readiness control 03 | gap | 3 | 0 | 3 | Policy/procedure artifact showing ownership and cadence for Containment.; Operational records (logs, tickets, reports, or runbooks) demonstrating Containment execution.; Review evidence with remediation tracking for Containment exceptions. |
DFIR-032 | Containment readiness control 04 | gap | 4 | 0 | 3 | Policy/procedure artifact showing ownership and cadence for Containment.; Operational records (logs, tickets, reports, or runbooks) demonstrating Containment execution.; Review evidence with remediation tracking for Containment exceptions. |
DFIR-033 | Containment readiness control 05 | gap | 5 | 0 | 3 | Policy/procedure artifact showing ownership and cadence for Containment.; Operational records (logs, tickets, reports, or runbooks) demonstrating Containment execution.; Review evidence with remediation tracking for Containment exceptions. |
DFIR-034 | Containment readiness control 06 | gap | 1 | 0 | 3 | Policy/procedure artifact showing ownership and cadence for Containment.; Operational records (logs, tickets, reports, or runbooks) demonstrating Containment execution.; Review evidence with remediation tracking for Containment exceptions. |
DFIR-035 | Containment readiness control 07 | gap | 2 | 0 | 3 | Policy/procedure artifact showing ownership and cadence for Containment.; Operational records (logs, tickets, reports, or runbooks) demonstrating Containment execution.; Review evidence with remediation tracking for Containment exceptions. |
DFIR-036 | Containment readiness control 08 | gap | 3 | 0 | 3 | Policy/procedure artifact showing ownership and cadence for Containment.; Operational records (logs, tickets, reports, or runbooks) demonstrating Containment execution.; Review evidence with remediation tracking for Containment exceptions. |
DFIR-037 | Containment readiness control 09 | gap | 4 | 0 | 3 | Policy/procedure artifact showing ownership and cadence for Containment.; Operational records (logs, tickets, reports, or runbooks) demonstrating Containment execution.; Review evidence with remediation tracking for Containment exceptions. |
DFIR-038 | Containment readiness control 10 | gap | 5 | 0 | 3 | Policy/procedure artifact showing ownership and cadence for Containment.; Operational records (logs, tickets, reports, or runbooks) demonstrating Containment execution.; Review evidence with remediation tracking for Containment exceptions. |
DFIR-039 | Containment readiness control 11 | gap | 1 | 0 | 3 | Policy/procedure artifact showing ownership and cadence for Containment.; Operational records (logs, tickets, reports, or runbooks) demonstrating Containment execution.; Review evidence with remediation tracking for Containment exceptions. |
DFIR-040 | Containment readiness control 12 | gap | 2 | 0 | 3 | Policy/procedure artifact showing ownership and cadence for Containment.; Operational records (logs, tickets, reports, or runbooks) demonstrating Containment execution.; Review evidence with remediation tracking for Containment exceptions. |
DFIR-041 | Containment readiness control 13 | gap | 3 | 0 | 3 | Policy/procedure artifact showing ownership and cadence for Containment.; Operational records (logs, tickets, reports, or runbooks) demonstrating Containment execution.; Review evidence with remediation tracking for Containment exceptions. |
DFIR-042 | Containment readiness control 14 | gap | 4 | 0 | 3 | Policy/procedure artifact showing ownership and cadence for Containment.; Operational records (logs, tickets, reports, or runbooks) demonstrating Containment execution.; Review evidence with remediation tracking for Containment exceptions. |
DFIR-043 | Eradication readiness control 01 | gap | 1 | 0 | 3 | Policy/procedure artifact showing ownership and cadence for Eradication.; Operational records (logs, tickets, reports, or runbooks) demonstrating Eradication execution.; Review evidence with remediation tracking for Eradication exceptions. |
DFIR-044 | Eradication readiness control 02 | gap | 2 | 0 | 3 | Policy/procedure artifact showing ownership and cadence for Eradication.; Operational records (logs, tickets, reports, or runbooks) demonstrating Eradication execution.; Review evidence with remediation tracking for Eradication exceptions. |
DFIR-045 | Eradication readiness control 03 | gap | 3 | 0 | 3 | Policy/procedure artifact showing ownership and cadence for Eradication.; Operational records (logs, tickets, reports, or runbooks) demonstrating Eradication execution.; Review evidence with remediation tracking for Eradication exceptions. |
DFIR-046 | Eradication readiness control 04 | gap | 4 | 0 | 3 | Policy/procedure artifact showing ownership and cadence for Eradication.; Operational records (logs, tickets, reports, or runbooks) demonstrating Eradication execution.; Review evidence with remediation tracking for Eradication exceptions. |
DFIR-047 | Eradication readiness control 05 | gap | 5 | 0 | 3 | Policy/procedure artifact showing ownership and cadence for Eradication.; Operational records (logs, tickets, reports, or runbooks) demonstrating Eradication execution.; Review evidence with remediation tracking for Eradication exceptions. |
DFIR-048 | Eradication readiness control 06 | gap | 1 | 0 | 3 | Policy/procedure artifact showing ownership and cadence for Eradication.; Operational records (logs, tickets, reports, or runbooks) demonstrating Eradication execution.; Review evidence with remediation tracking for Eradication exceptions. |
DFIR-049 | Eradication readiness control 07 | gap | 2 | 0 | 3 | Policy/procedure artifact showing ownership and cadence for Eradication.; Operational records (logs, tickets, reports, or runbooks) demonstrating Eradication execution.; Review evidence with remediation tracking for Eradication exceptions. |
DFIR-050 | Eradication readiness control 08 | gap | 3 | 0 | 3 | Policy/procedure artifact showing ownership and cadence for Eradication.; Operational records (logs, tickets, reports, or runbooks) demonstrating Eradication execution.; Review evidence with remediation tracking for Eradication exceptions. |
DFIR-051 | Eradication readiness control 09 | gap | 4 | 0 | 3 | Policy/procedure artifact showing ownership and cadence for Eradication.; Operational records (logs, tickets, reports, or runbooks) demonstrating Eradication execution.; Review evidence with remediation tracking for Eradication exceptions. |
DFIR-052 | Eradication readiness control 10 | gap | 5 | 0 | 3 | Policy/procedure artifact showing ownership and cadence for Eradication.; Operational records (logs, tickets, reports, or runbooks) demonstrating Eradication execution.; Review evidence with remediation tracking for Eradication exceptions. |
DFIR-053 | Eradication readiness control 11 | gap | 1 | 0 | 3 | Policy/procedure artifact showing ownership and cadence for Eradication.; Operational records (logs, tickets, reports, or runbooks) demonstrating Eradication execution.; Review evidence with remediation tracking for Eradication exceptions. |
DFIR-054 | Eradication readiness control 12 | gap | 2 | 0 | 3 | Policy/procedure artifact showing ownership and cadence for Eradication.; Operational records (logs, tickets, reports, or runbooks) demonstrating Eradication execution.; Review evidence with remediation tracking for Eradication exceptions. |
DFIR-055 | Eradication readiness control 13 | gap | 3 | 0 | 3 | Policy/procedure artifact showing ownership and cadence for Eradication.; Operational records (logs, tickets, reports, or runbooks) demonstrating Eradication execution.; Review evidence with remediation tracking for Eradication exceptions. |
DFIR-056 | Eradication readiness control 14 | gap | 4 | 0 | 3 | Policy/procedure artifact showing ownership and cadence for Eradication.; Operational records (logs, tickets, reports, or runbooks) demonstrating Eradication execution.; Review evidence with remediation tracking for Eradication exceptions. |
DFIR-057 | Recovery readiness control 01 | gap | 1 | 0 | 3 | Policy/procedure artifact showing ownership and cadence for Recovery.; Operational records (logs, tickets, reports, or runbooks) demonstrating Recovery execution.; Review evidence with remediation tracking for Recovery exceptions. |
DFIR-058 | Recovery readiness control 02 | gap | 2 | 0 | 3 | Policy/procedure artifact showing ownership and cadence for Recovery.; Operational records (logs, tickets, reports, or runbooks) demonstrating Recovery execution.; Review evidence with remediation tracking for Recovery exceptions. |
DFIR-059 | Recovery readiness control 03 | gap | 3 | 0 | 3 | Policy/procedure artifact showing ownership and cadence for Recovery.; Operational records (logs, tickets, reports, or runbooks) demonstrating Recovery execution.; Review evidence with remediation tracking for Recovery exceptions. |
DFIR-060 | Recovery readiness control 04 | gap | 4 | 0 | 3 | Policy/procedure artifact showing ownership and cadence for Recovery.; Operational records (logs, tickets, reports, or runbooks) demonstrating Recovery execution.; Review evidence with remediation tracking for Recovery exceptions. |
DFIR-061 | Recovery readiness control 05 | gap | 5 | 0 | 3 | Policy/procedure artifact showing ownership and cadence for Recovery.; Operational records (logs, tickets, reports, or runbooks) demonstrating Recovery execution.; Review evidence with remediation tracking for Recovery exceptions. |
DFIR-062 | Recovery readiness control 06 | gap | 1 | 0 | 3 | Policy/procedure artifact showing ownership and cadence for Recovery.; Operational records (logs, tickets, reports, or runbooks) demonstrating Recovery execution.; Review evidence with remediation tracking for Recovery exceptions. |
DFIR-063 | Recovery readiness control 07 | gap | 2 | 0 | 3 | Policy/procedure artifact showing ownership and cadence for Recovery.; Operational records (logs, tickets, reports, or runbooks) demonstrating Recovery execution.; Review evidence with remediation tracking for Recovery exceptions. |
DFIR-064 | Recovery readiness control 08 | gap | 3 | 0 | 3 | Policy/procedure artifact showing ownership and cadence for Recovery.; Operational records (logs, tickets, reports, or runbooks) demonstrating Recovery execution.; Review evidence with remediation tracking for Recovery exceptions. |
DFIR-065 | Recovery readiness control 09 | gap | 4 | 0 | 3 | Policy/procedure artifact showing ownership and cadence for Recovery.; Operational records (logs, tickets, reports, or runbooks) demonstrating Recovery execution.; Review evidence with remediation tracking for Recovery exceptions. |
DFIR-066 | Recovery readiness control 10 | gap | 5 | 0 | 3 | Policy/procedure artifact showing ownership and cadence for Recovery.; Operational records (logs, tickets, reports, or runbooks) demonstrating Recovery execution.; Review evidence with remediation tracking for Recovery exceptions. |
DFIR-067 | Recovery readiness control 11 | gap | 1 | 0 | 3 | Policy/procedure artifact showing ownership and cadence for Recovery.; Operational records (logs, tickets, reports, or runbooks) demonstrating Recovery execution.; Review evidence with remediation tracking for Recovery exceptions. |
DFIR-068 | Recovery readiness control 12 | gap | 2 | 0 | 3 | Policy/procedure artifact showing ownership and cadence for Recovery.; Operational records (logs, tickets, reports, or runbooks) demonstrating Recovery execution.; Review evidence with remediation tracking for Recovery exceptions. |
DFIR-069 | Recovery readiness control 13 | gap | 3 | 0 | 3 | Policy/procedure artifact showing ownership and cadence for Recovery.; Operational records (logs, tickets, reports, or runbooks) demonstrating Recovery execution.; Review evidence with remediation tracking for Recovery exceptions. |
DFIR-070 | Recovery readiness control 14 | gap | 4 | 0 | 3 | Policy/procedure artifact showing ownership and cadence for Recovery.; Operational records (logs, tickets, reports, or runbooks) demonstrating Recovery execution.; Review evidence with remediation tracking for Recovery exceptions. |
DFIR-071 | PostIncident readiness control 01 | gap | 1 | 0 | 3 | Policy/procedure artifact showing ownership and cadence for PostIncident.; Operational records (logs, tickets, reports, or runbooks) demonstrating PostIncident execution.; Review evidence with remediation tracking for PostIncident exceptions. |
DFIR-072 | PostIncident readiness control 02 | gap | 2 | 0 | 3 | Policy/procedure artifact showing ownership and cadence for PostIncident.; Operational records (logs, tickets, reports, or runbooks) demonstrating PostIncident execution.; Review evidence with remediation tracking for PostIncident exceptions. |
DFIR-073 | PostIncident readiness control 03 | gap | 3 | 0 | 3 | Policy/procedure artifact showing ownership and cadence for PostIncident.; Operational records (logs, tickets, reports, or runbooks) demonstrating PostIncident execution.; Review evidence with remediation tracking for PostIncident exceptions. |
DFIR-074 | PostIncident readiness control 04 | gap | 4 | 0 | 3 | Policy/procedure artifact showing ownership and cadence for PostIncident.; Operational records (logs, tickets, reports, or runbooks) demonstrating PostIncident execution.; Review evidence with remediation tracking for PostIncident exceptions. |
DFIR-075 | PostIncident readiness control 05 | gap | 5 | 0 | 3 | Policy/procedure artifact showing ownership and cadence for PostIncident.; Operational records (logs, tickets, reports, or runbooks) demonstrating PostIncident execution.; Review evidence with remediation tracking for PostIncident exceptions. |
DFIR-076 | PostIncident readiness control 06 | gap | 1 | 0 | 3 | Policy/procedure artifact showing ownership and cadence for PostIncident.; Operational records (logs, tickets, reports, or runbooks) demonstrating PostIncident execution.; Review evidence with remediation tracking for PostIncident exceptions. |
DFIR-077 | PostIncident readiness control 07 | gap | 2 | 0 | 3 | Policy/procedure artifact showing ownership and cadence for PostIncident.; Operational records (logs, tickets, reports, or runbooks) demonstrating PostIncident execution.; Review evidence with remediation tracking for PostIncident exceptions. |
DFIR-078 | PostIncident readiness control 08 | gap | 3 | 0 | 3 | Policy/procedure artifact showing ownership and cadence for PostIncident.; Operational records (logs, tickets, reports, or runbooks) demonstrating PostIncident execution.; Review evidence with remediation tracking for PostIncident exceptions. |
DFIR-079 | PostIncident readiness control 09 | gap | 4 | 0 | 3 | Policy/procedure artifact showing ownership and cadence for PostIncident.; Operational records (logs, tickets, reports, or runbooks) demonstrating PostIncident execution.; Review evidence with remediation tracking for PostIncident exceptions. |
DFIR-080 | PostIncident readiness control 10 | gap | 5 | 0 | 3 | Policy/procedure artifact showing ownership and cadence for PostIncident.; Operational records (logs, tickets, reports, or runbooks) demonstrating PostIncident execution.; Review evidence with remediation tracking for PostIncident exceptions. |
DFIR-081 | PostIncident readiness control 11 | gap | 1 | 0 | 3 | Policy/procedure artifact showing ownership and cadence for PostIncident.; Operational records (logs, tickets, reports, or runbooks) demonstrating PostIncident execution.; Review evidence with remediation tracking for PostIncident exceptions. |
DFIR-082 | PostIncident readiness control 12 | gap | 2 | 0 | 3 | Policy/procedure artifact showing ownership and cadence for PostIncident.; Operational records (logs, tickets, reports, or runbooks) demonstrating PostIncident execution.; Review evidence with remediation tracking for PostIncident exceptions. |
DFIR-083 | PostIncident readiness control 13 | gap | 3 | 0 | 3 | Policy/procedure artifact showing ownership and cadence for PostIncident.; Operational records (logs, tickets, reports, or runbooks) demonstrating PostIncident execution.; Review evidence with remediation tracking for PostIncident exceptions. |
DFIR-084 | PostIncident readiness control 14 | gap | 4 | 0 | 3 | Policy/procedure artifact showing ownership and cadence for PostIncident.; Operational records (logs, tickets, reports, or runbooks) demonstrating PostIncident execution.; Review evidence with remediation tracking for PostIncident exceptions. |
Evidence Appendix
DFIR-001 - Preparation readiness control 01
gap | severity 1 | evidence_count 0
Ensure Preparation procedures are documented, exercised, and reproducible for incident response readiness.
Expected evidence: Policy/procedure artifact showing ownership and cadence for Preparation.; Operational records (logs, tickets, reports, or runbooks) demonstrating Preparation execution.; Review evidence with remediation tracking for Preparation exceptions.
DFIR-Q-001 - incident response plan evidence owner review log ticket runbook timeline
tags: preparation, planning, governance, readiness, incident_response, dfir | hits: 0
No direct evidence hits for this query.
DFIR-Q-005 - chain-of-custody template evidence owner review log ticket runbook timeline
tags: preparation, planning, governance, readiness, incident_response, dfir, evidence, forensics | hits: 0
No direct evidence hits for this query.
DFIR-Q-006 - escalation matrix evidence owner review log ticket runbook timeline
tags: preparation, planning, governance, readiness, incident_response, dfir | hits: 0
No direct evidence hits for this query.
DFIR-Q-007 - training exercise records evidence owner review log ticket runbook timeline
tags: preparation, planning, governance, readiness, incident_response, dfir | hits: 0
No direct evidence hits for this query.
DFIR-Q-008 - tabletop outcomes evidence owner review log ticket runbook timeline
tags: preparation, planning, governance, readiness, incident_response, dfir | hits: 0
No direct evidence hits for this query.
DFIR-Q-041 - post-incident review minutes evidence owner review log ticket runbook timeline
tags: postincident, lessons_learned, improvement, governance, incident_response, dfir, readiness | hits: 0
No direct evidence hits for this query.
DFIR-002 - Preparation readiness control 02
gap | severity 2 | evidence_count 0
Ensure Preparation procedures are documented, exercised, and reproducible for incident response readiness.
Expected evidence: Policy/procedure artifact showing ownership and cadence for Preparation.; Operational records (logs, tickets, reports, or runbooks) demonstrating Preparation execution.; Review evidence with remediation tracking for Preparation exceptions.
DFIR-Q-001 - incident response plan evidence owner review log ticket runbook timeline
tags: preparation, planning, governance, readiness, incident_response, dfir | hits: 0
No direct evidence hits for this query.
DFIR-Q-006 - escalation matrix evidence owner review log ticket runbook timeline
tags: preparation, planning, governance, readiness, incident_response, dfir | hits: 0
No direct evidence hits for this query.
DFIR-Q-007 - training exercise records evidence owner review log ticket runbook timeline
tags: preparation, planning, governance, readiness, incident_response, dfir | hits: 0
No direct evidence hits for this query.
DFIR-Q-008 - tabletop outcomes evidence owner review log ticket runbook timeline
tags: preparation, planning, governance, readiness, incident_response, dfir | hits: 0
No direct evidence hits for this query.
DFIR-Q-041 - post-incident review minutes evidence owner review log ticket runbook timeline
tags: postincident, lessons_learned, improvement, governance, incident_response, dfir, readiness | hits: 0
No direct evidence hits for this query.
DFIR-Q-042 - lessons learned register evidence owner review log ticket runbook timeline
tags: postincident, lessons_learned, improvement, governance, incident_response, dfir, readiness | hits: 0
No direct evidence hits for this query.
DFIR-003 - Preparation readiness control 03
gap | severity 3 | evidence_count 0
Ensure Preparation procedures are documented, exercised, and reproducible for incident response readiness.
Expected evidence: Policy/procedure artifact showing ownership and cadence for Preparation.; Operational records (logs, tickets, reports, or runbooks) demonstrating Preparation execution.; Review evidence with remediation tracking for Preparation exceptions.
DFIR-Q-001 - incident response plan evidence owner review log ticket runbook timeline
tags: preparation, planning, governance, readiness, incident_response, dfir | hits: 0
No direct evidence hits for this query.
DFIR-Q-002 - communications playbook evidence owner review log ticket runbook timeline
tags: preparation, planning, governance, readiness, incident_response, dfir, communications | hits: 0
No direct evidence hits for this query.
DFIR-Q-006 - escalation matrix evidence owner review log ticket runbook timeline
tags: preparation, planning, governance, readiness, incident_response, dfir | hits: 0
No direct evidence hits for this query.
DFIR-Q-007 - training exercise records evidence owner review log ticket runbook timeline
tags: preparation, planning, governance, readiness, incident_response, dfir | hits: 0
No direct evidence hits for this query.
DFIR-Q-008 - tabletop outcomes evidence owner review log ticket runbook timeline
tags: preparation, planning, governance, readiness, incident_response, dfir | hits: 0
No direct evidence hits for this query.
DFIR-Q-042 - lessons learned register evidence owner review log ticket runbook timeline
tags: postincident, lessons_learned, improvement, governance, incident_response, dfir, readiness | hits: 0
No direct evidence hits for this query.
DFIR-Q-043 - corrective action tracker evidence owner review log ticket runbook timeline
tags: postincident, lessons_learned, improvement, governance, incident_response, dfir, readiness | hits: 0
No direct evidence hits for this query.
DFIR-004 - Preparation readiness control 04
gap | severity 4 | evidence_count 0
Ensure Preparation procedures are documented, exercised, and reproducible for incident response readiness.
Expected evidence: Policy/procedure artifact showing ownership and cadence for Preparation.; Operational records (logs, tickets, reports, or runbooks) demonstrating Preparation execution.; Review evidence with remediation tracking for Preparation exceptions.
DFIR-Q-001 - incident response plan evidence owner review log ticket runbook timeline
tags: preparation, planning, governance, readiness, incident_response, dfir | hits: 0
No direct evidence hits for this query.
DFIR-Q-002 - communications playbook evidence owner review log ticket runbook timeline
tags: preparation, planning, governance, readiness, incident_response, dfir, communications | hits: 0
No direct evidence hits for this query.
DFIR-Q-007 - training exercise records evidence owner review log ticket runbook timeline
tags: preparation, planning, governance, readiness, incident_response, dfir | hits: 0
No direct evidence hits for this query.
DFIR-Q-008 - tabletop outcomes evidence owner review log ticket runbook timeline
tags: preparation, planning, governance, readiness, incident_response, dfir | hits: 0
No direct evidence hits for this query.
DFIR-Q-043 - corrective action tracker evidence owner review log ticket runbook timeline
tags: postincident, lessons_learned, improvement, governance, incident_response, dfir, readiness | hits: 0
No direct evidence hits for this query.
DFIR-Q-044 - policy update changelog evidence owner review log ticket runbook timeline
tags: postincident, lessons_learned, improvement, governance, incident_response, dfir, readiness, change_management | hits: 0
No direct evidence hits for this query.
DFIR-005 - Preparation readiness control 05
gap | severity 5 | evidence_count 0
Ensure Preparation procedures are documented, exercised, and reproducible for incident response readiness.
Expected evidence: Policy/procedure artifact showing ownership and cadence for Preparation.; Operational records (logs, tickets, reports, or runbooks) demonstrating Preparation execution.; Review evidence with remediation tracking for Preparation exceptions.
DFIR-Q-001 - incident response plan evidence owner review log ticket runbook timeline
tags: preparation, planning, governance, readiness, incident_response, dfir | hits: 0
No direct evidence hits for this query.
DFIR-Q-002 - communications playbook evidence owner review log ticket runbook timeline
tags: preparation, planning, governance, readiness, incident_response, dfir, communications | hits: 0
No direct evidence hits for this query.
DFIR-Q-003 - stakeholder contact list evidence owner review log ticket runbook timeline
tags: preparation, planning, governance, readiness, incident_response, dfir | hits: 0
No direct evidence hits for this query.
DFIR-Q-007 - training exercise records evidence owner review log ticket runbook timeline
tags: preparation, planning, governance, readiness, incident_response, dfir | hits: 0
No direct evidence hits for this query.
DFIR-Q-008 - tabletop outcomes evidence owner review log ticket runbook timeline
tags: preparation, planning, governance, readiness, incident_response, dfir | hits: 0
No direct evidence hits for this query.
DFIR-Q-044 - policy update changelog evidence owner review log ticket runbook timeline
tags: postincident, lessons_learned, improvement, governance, incident_response, dfir, readiness, change_management | hits: 0
No direct evidence hits for this query.
DFIR-Q-045 - control improvement backlog evidence owner review log ticket runbook timeline
tags: postincident, lessons_learned, improvement, governance, incident_response, dfir, readiness | hits: 0
No direct evidence hits for this query.
DFIR-006 - Preparation readiness control 06
gap | severity 1 | evidence_count 0
Ensure Preparation procedures are documented, exercised, and reproducible for incident response readiness.
Expected evidence: Policy/procedure artifact showing ownership and cadence for Preparation.; Operational records (logs, tickets, reports, or runbooks) demonstrating Preparation execution.; Review evidence with remediation tracking for Preparation exceptions.
DFIR-Q-001 - incident response plan evidence owner review log ticket runbook timeline
tags: preparation, planning, governance, readiness, incident_response, dfir | hits: 0
No direct evidence hits for this query.
DFIR-Q-002 - communications playbook evidence owner review log ticket runbook timeline
tags: preparation, planning, governance, readiness, incident_response, dfir, communications | hits: 0
No direct evidence hits for this query.
DFIR-Q-003 - stakeholder contact list evidence owner review log ticket runbook timeline
tags: preparation, planning, governance, readiness, incident_response, dfir | hits: 0
No direct evidence hits for this query.
DFIR-Q-008 - tabletop outcomes evidence owner review log ticket runbook timeline
tags: preparation, planning, governance, readiness, incident_response, dfir | hits: 0
No direct evidence hits for this query.
DFIR-Q-045 - control improvement backlog evidence owner review log ticket runbook timeline
tags: postincident, lessons_learned, improvement, governance, incident_response, dfir, readiness | hits: 0
No direct evidence hits for this query.
DFIR-Q-046 - executive briefing records evidence owner review log ticket runbook timeline
tags: postincident, lessons_learned, improvement, governance, incident_response, dfir, readiness | hits: 0
No direct evidence hits for this query.
DFIR-007 - Preparation readiness control 07
gap | severity 2 | evidence_count 0
Ensure Preparation procedures are documented, exercised, and reproducible for incident response readiness.
Expected evidence: Policy/procedure artifact showing ownership and cadence for Preparation.; Operational records (logs, tickets, reports, or runbooks) demonstrating Preparation execution.; Review evidence with remediation tracking for Preparation exceptions.
DFIR-Q-001 - incident response plan evidence owner review log ticket runbook timeline
tags: preparation, planning, governance, readiness, incident_response, dfir | hits: 0
No direct evidence hits for this query.
DFIR-Q-002 - communications playbook evidence owner review log ticket runbook timeline
tags: preparation, planning, governance, readiness, incident_response, dfir, communications | hits: 0
No direct evidence hits for this query.
DFIR-Q-003 - stakeholder contact list evidence owner review log ticket runbook timeline
tags: preparation, planning, governance, readiness, incident_response, dfir | hits: 0
No direct evidence hits for this query.
DFIR-Q-004 - evidence handling standards evidence owner review log ticket runbook timeline
tags: preparation, planning, governance, readiness, incident_response, dfir, evidence, forensics | hits: 0
No direct evidence hits for this query.
DFIR-Q-008 - tabletop outcomes evidence owner review log ticket runbook timeline
tags: preparation, planning, governance, readiness, incident_response, dfir | hits: 0
No direct evidence hits for this query.
DFIR-Q-046 - executive briefing records evidence owner review log ticket runbook timeline
tags: postincident, lessons_learned, improvement, governance, incident_response, dfir, readiness | hits: 0
No direct evidence hits for this query.
DFIR-Q-047 - regulator/customer comms log evidence owner review log ticket runbook timeline
tags: postincident, lessons_learned, improvement, governance, incident_response, dfir, readiness, communications | hits: 0
No direct evidence hits for this query.
DFIR-008 - Preparation readiness control 08
gap | severity 3 | evidence_count 0
Ensure Preparation procedures are documented, exercised, and reproducible for incident response readiness.
Expected evidence: Policy/procedure artifact showing ownership and cadence for Preparation.; Operational records (logs, tickets, reports, or runbooks) demonstrating Preparation execution.; Review evidence with remediation tracking for Preparation exceptions.
DFIR-Q-002 - communications playbook evidence owner review log ticket runbook timeline
tags: preparation, planning, governance, readiness, incident_response, dfir, communications | hits: 0
No direct evidence hits for this query.
DFIR-Q-003 - stakeholder contact list evidence owner review log ticket runbook timeline
tags: preparation, planning, governance, readiness, incident_response, dfir | hits: 0
No direct evidence hits for this query.
DFIR-Q-004 - evidence handling standards evidence owner review log ticket runbook timeline
tags: preparation, planning, governance, readiness, incident_response, dfir, evidence, forensics | hits: 0
No direct evidence hits for this query.
DFIR-Q-047 - regulator/customer comms log evidence owner review log ticket runbook timeline
tags: postincident, lessons_learned, improvement, governance, incident_response, dfir, readiness, communications | hits: 0
No direct evidence hits for this query.
DFIR-Q-048 - evidence retention decisions evidence owner review log ticket runbook timeline
tags: postincident, lessons_learned, improvement, governance, incident_response, dfir, readiness, evidence, forensics | hits: 0
No direct evidence hits for this query.
DFIR-009 - Preparation readiness control 09
gap | severity 4 | evidence_count 0
Ensure Preparation procedures are documented, exercised, and reproducible for incident response readiness.
Expected evidence: Policy/procedure artifact showing ownership and cadence for Preparation.; Operational records (logs, tickets, reports, or runbooks) demonstrating Preparation execution.; Review evidence with remediation tracking for Preparation exceptions.
DFIR-Q-002 - communications playbook evidence owner review log ticket runbook timeline
tags: preparation, planning, governance, readiness, incident_response, dfir, communications | hits: 0
No direct evidence hits for this query.
DFIR-Q-003 - stakeholder contact list evidence owner review log ticket runbook timeline
tags: preparation, planning, governance, readiness, incident_response, dfir | hits: 0
No direct evidence hits for this query.
DFIR-Q-004 - evidence handling standards evidence owner review log ticket runbook timeline
tags: preparation, planning, governance, readiness, incident_response, dfir, evidence, forensics | hits: 0
No direct evidence hits for this query.
DFIR-Q-005 - chain-of-custody template evidence owner review log ticket runbook timeline
tags: preparation, planning, governance, readiness, incident_response, dfir, evidence, forensics | hits: 0
No direct evidence hits for this query.
DFIR-Q-048 - evidence retention decisions evidence owner review log ticket runbook timeline
tags: postincident, lessons_learned, improvement, governance, incident_response, dfir, readiness, evidence, forensics | hits: 0
No direct evidence hits for this query.
DFIR-010 - Preparation readiness control 10
gap | severity 5 | evidence_count 0
Ensure Preparation procedures are documented, exercised, and reproducible for incident response readiness.
Expected evidence: Policy/procedure artifact showing ownership and cadence for Preparation.; Operational records (logs, tickets, reports, or runbooks) demonstrating Preparation execution.; Review evidence with remediation tracking for Preparation exceptions.
DFIR-Q-003 - stakeholder contact list evidence owner review log ticket runbook timeline
tags: preparation, planning, governance, readiness, incident_response, dfir | hits: 0
No direct evidence hits for this query.
DFIR-Q-004 - evidence handling standards evidence owner review log ticket runbook timeline
tags: preparation, planning, governance, readiness, incident_response, dfir, evidence, forensics | hits: 0
No direct evidence hits for this query.
DFIR-Q-005 - chain-of-custody template evidence owner review log ticket runbook timeline
tags: preparation, planning, governance, readiness, incident_response, dfir, evidence, forensics | hits: 0
No direct evidence hits for this query.
DFIR-011 - Preparation readiness control 11
gap | severity 1 | evidence_count 0
Ensure Preparation procedures are documented, exercised, and reproducible for incident response readiness.
Expected evidence: Policy/procedure artifact showing ownership and cadence for Preparation.; Operational records (logs, tickets, reports, or runbooks) demonstrating Preparation execution.; Review evidence with remediation tracking for Preparation exceptions.
DFIR-Q-003 - stakeholder contact list evidence owner review log ticket runbook timeline
tags: preparation, planning, governance, readiness, incident_response, dfir | hits: 0
No direct evidence hits for this query.
DFIR-Q-004 - evidence handling standards evidence owner review log ticket runbook timeline
tags: preparation, planning, governance, readiness, incident_response, dfir, evidence, forensics | hits: 0
No direct evidence hits for this query.
DFIR-Q-005 - chain-of-custody template evidence owner review log ticket runbook timeline
tags: preparation, planning, governance, readiness, incident_response, dfir, evidence, forensics | hits: 0
No direct evidence hits for this query.
DFIR-Q-006 - escalation matrix evidence owner review log ticket runbook timeline
tags: preparation, planning, governance, readiness, incident_response, dfir | hits: 0
No direct evidence hits for this query.
DFIR-012 - Preparation readiness control 12
gap | severity 2 | evidence_count 0
Ensure Preparation procedures are documented, exercised, and reproducible for incident response readiness.
Expected evidence: Policy/procedure artifact showing ownership and cadence for Preparation.; Operational records (logs, tickets, reports, or runbooks) demonstrating Preparation execution.; Review evidence with remediation tracking for Preparation exceptions.
DFIR-Q-004 - evidence handling standards evidence owner review log ticket runbook timeline
tags: preparation, planning, governance, readiness, incident_response, dfir, evidence, forensics | hits: 0
No direct evidence hits for this query.
DFIR-Q-005 - chain-of-custody template evidence owner review log ticket runbook timeline
tags: preparation, planning, governance, readiness, incident_response, dfir, evidence, forensics | hits: 0
No direct evidence hits for this query.
DFIR-Q-006 - escalation matrix evidence owner review log ticket runbook timeline
tags: preparation, planning, governance, readiness, incident_response, dfir | hits: 0
No direct evidence hits for this query.
DFIR-013 - Preparation readiness control 13
gap | severity 3 | evidence_count 0
Ensure Preparation procedures are documented, exercised, and reproducible for incident response readiness.
Expected evidence: Policy/procedure artifact showing ownership and cadence for Preparation.; Operational records (logs, tickets, reports, or runbooks) demonstrating Preparation execution.; Review evidence with remediation tracking for Preparation exceptions.
DFIR-Q-004 - evidence handling standards evidence owner review log ticket runbook timeline
tags: preparation, planning, governance, readiness, incident_response, dfir, evidence, forensics | hits: 0
No direct evidence hits for this query.
DFIR-Q-005 - chain-of-custody template evidence owner review log ticket runbook timeline
tags: preparation, planning, governance, readiness, incident_response, dfir, evidence, forensics | hits: 0
No direct evidence hits for this query.
DFIR-Q-006 - escalation matrix evidence owner review log ticket runbook timeline
tags: preparation, planning, governance, readiness, incident_response, dfir | hits: 0
No direct evidence hits for this query.
DFIR-Q-007 - training exercise records evidence owner review log ticket runbook timeline
tags: preparation, planning, governance, readiness, incident_response, dfir | hits: 0
No direct evidence hits for this query.
DFIR-014 - Preparation readiness control 14
gap | severity 4 | evidence_count 0
Ensure Preparation procedures are documented, exercised, and reproducible for incident response readiness.
Expected evidence: Policy/procedure artifact showing ownership and cadence for Preparation.; Operational records (logs, tickets, reports, or runbooks) demonstrating Preparation execution.; Review evidence with remediation tracking for Preparation exceptions.
DFIR-Q-005 - chain-of-custody template evidence owner review log ticket runbook timeline
tags: preparation, planning, governance, readiness, incident_response, dfir, evidence, forensics | hits: 0
No direct evidence hits for this query.
DFIR-Q-006 - escalation matrix evidence owner review log ticket runbook timeline
tags: preparation, planning, governance, readiness, incident_response, dfir | hits: 0
No direct evidence hits for this query.
DFIR-Q-007 - training exercise records evidence owner review log ticket runbook timeline
tags: preparation, planning, governance, readiness, incident_response, dfir | hits: 0
No direct evidence hits for this query.
DFIR-015 - DetectionAnalysis readiness control 01
gap | severity 1 | evidence_count 0
Ensure DetectionAnalysis procedures are documented, exercised, and reproducible for incident response readiness.
Expected evidence: Policy/procedure artifact showing ownership and cadence for DetectionAnalysis.; Operational records (logs, tickets, reports, or runbooks) demonstrating DetectionAnalysis execution.; Review evidence with remediation tracking for DetectionAnalysis exceptions.
DFIR-Q-001 - incident response plan evidence owner review log ticket runbook timeline
tags: preparation, planning, governance, readiness, incident_response, dfir | hits: 0
No direct evidence hits for this query.
DFIR-Q-009 - edr telemetry evidence evidence owner review log ticket runbook timeline
tags: detection, analysis, triage, telemetry, incident_response, dfir, readiness, logging, monitoring, evidence, forensics | hits: 0
No direct evidence hits for this query.
DFIR-Q-013 - ioc tracking artifacts evidence owner review log ticket runbook timeline
tags: detection, analysis, triage, telemetry, incident_response, dfir, readiness | hits: 0
No direct evidence hits for this query.
DFIR-Q-014 - time sync ntp evidence evidence owner review log ticket runbook timeline
tags: detection, analysis, triage, telemetry, incident_response, dfir, readiness, evidence, forensics, time_sync | hits: 0
No direct evidence hits for this query.
DFIR-Q-015 - logging retention policy evidence owner review log ticket runbook timeline
tags: detection, analysis, triage, telemetry, incident_response, dfir, readiness, logging, monitoring | hits: 0
No direct evidence hits for this query.
DFIR-Q-016 - admin account monitoring records evidence owner review log ticket runbook timeline
tags: detection, analysis, triage, telemetry, incident_response, dfir, readiness, privileged_access | hits: 0
No direct evidence hits for this query.
DFIR-016 - DetectionAnalysis readiness control 02
gap | severity 2 | evidence_count 0
Ensure DetectionAnalysis procedures are documented, exercised, and reproducible for incident response readiness.
Expected evidence: Policy/procedure artifact showing ownership and cadence for DetectionAnalysis.; Operational records (logs, tickets, reports, or runbooks) demonstrating DetectionAnalysis execution.; Review evidence with remediation tracking for DetectionAnalysis exceptions.
DFIR-Q-001 - incident response plan evidence owner review log ticket runbook timeline
tags: preparation, planning, governance, readiness, incident_response, dfir | hits: 0
No direct evidence hits for this query.
DFIR-Q-002 - communications playbook evidence owner review log ticket runbook timeline
tags: preparation, planning, governance, readiness, incident_response, dfir, communications | hits: 0
No direct evidence hits for this query.
DFIR-Q-009 - edr telemetry evidence evidence owner review log ticket runbook timeline
tags: detection, analysis, triage, telemetry, incident_response, dfir, readiness, logging, monitoring, evidence, forensics | hits: 0
No direct evidence hits for this query.
DFIR-Q-014 - time sync ntp evidence evidence owner review log ticket runbook timeline
tags: detection, analysis, triage, telemetry, incident_response, dfir, readiness, evidence, forensics, time_sync | hits: 0
No direct evidence hits for this query.
DFIR-Q-015 - logging retention policy evidence owner review log ticket runbook timeline
tags: detection, analysis, triage, telemetry, incident_response, dfir, readiness, logging, monitoring | hits: 0
No direct evidence hits for this query.
DFIR-Q-016 - admin account monitoring records evidence owner review log ticket runbook timeline
tags: detection, analysis, triage, telemetry, incident_response, dfir, readiness, privileged_access | hits: 0
No direct evidence hits for this query.
DFIR-017 - DetectionAnalysis readiness control 03
gap | severity 3 | evidence_count 0
Ensure DetectionAnalysis procedures are documented, exercised, and reproducible for incident response readiness.
Expected evidence: Policy/procedure artifact showing ownership and cadence for DetectionAnalysis.; Operational records (logs, tickets, reports, or runbooks) demonstrating DetectionAnalysis execution.; Review evidence with remediation tracking for DetectionAnalysis exceptions.
DFIR-Q-002 - communications playbook evidence owner review log ticket runbook timeline
tags: preparation, planning, governance, readiness, incident_response, dfir, communications | hits: 0
No direct evidence hits for this query.
DFIR-Q-003 - stakeholder contact list evidence owner review log ticket runbook timeline
tags: preparation, planning, governance, readiness, incident_response, dfir | hits: 0
No direct evidence hits for this query.
DFIR-Q-009 - edr telemetry evidence evidence owner review log ticket runbook timeline
tags: detection, analysis, triage, telemetry, incident_response, dfir, readiness, logging, monitoring, evidence, forensics | hits: 0
No direct evidence hits for this query.
DFIR-Q-010 - siem alert triage logs evidence owner review log ticket runbook timeline
tags: detection, analysis, triage, telemetry, incident_response, dfir, readiness, logging, monitoring | hits: 0
No direct evidence hits for this query.
DFIR-Q-014 - time sync ntp evidence evidence owner review log ticket runbook timeline
tags: detection, analysis, triage, telemetry, incident_response, dfir, readiness, evidence, forensics, time_sync | hits: 0
No direct evidence hits for this query.
DFIR-Q-015 - logging retention policy evidence owner review log ticket runbook timeline
tags: detection, analysis, triage, telemetry, incident_response, dfir, readiness, logging, monitoring | hits: 0
No direct evidence hits for this query.
DFIR-Q-016 - admin account monitoring records evidence owner review log ticket runbook timeline
tags: detection, analysis, triage, telemetry, incident_response, dfir, readiness, privileged_access | hits: 0
No direct evidence hits for this query.
DFIR-018 - DetectionAnalysis readiness control 04
gap | severity 4 | evidence_count 0
Ensure DetectionAnalysis procedures are documented, exercised, and reproducible for incident response readiness.
Expected evidence: Policy/procedure artifact showing ownership and cadence for DetectionAnalysis.; Operational records (logs, tickets, reports, or runbooks) demonstrating DetectionAnalysis execution.; Review evidence with remediation tracking for DetectionAnalysis exceptions.
DFIR-Q-003 - stakeholder contact list evidence owner review log ticket runbook timeline
tags: preparation, planning, governance, readiness, incident_response, dfir | hits: 0
No direct evidence hits for this query.
DFIR-Q-004 - evidence handling standards evidence owner review log ticket runbook timeline
tags: preparation, planning, governance, readiness, incident_response, dfir, evidence, forensics | hits: 0
No direct evidence hits for this query.
DFIR-Q-009 - edr telemetry evidence evidence owner review log ticket runbook timeline
tags: detection, analysis, triage, telemetry, incident_response, dfir, readiness, logging, monitoring, evidence, forensics | hits: 0
No direct evidence hits for this query.
DFIR-Q-010 - siem alert triage logs evidence owner review log ticket runbook timeline
tags: detection, analysis, triage, telemetry, incident_response, dfir, readiness, logging, monitoring | hits: 0
No direct evidence hits for this query.
DFIR-Q-015 - logging retention policy evidence owner review log ticket runbook timeline
tags: detection, analysis, triage, telemetry, incident_response, dfir, readiness, logging, monitoring | hits: 0
No direct evidence hits for this query.
DFIR-Q-016 - admin account monitoring records evidence owner review log ticket runbook timeline
tags: detection, analysis, triage, telemetry, incident_response, dfir, readiness, privileged_access | hits: 0
No direct evidence hits for this query.
DFIR-019 - DetectionAnalysis readiness control 05
gap | severity 5 | evidence_count 0
Ensure DetectionAnalysis procedures are documented, exercised, and reproducible for incident response readiness.
Expected evidence: Policy/procedure artifact showing ownership and cadence for DetectionAnalysis.; Operational records (logs, tickets, reports, or runbooks) demonstrating DetectionAnalysis execution.; Review evidence with remediation tracking for DetectionAnalysis exceptions.
DFIR-Q-004 - evidence handling standards evidence owner review log ticket runbook timeline
tags: preparation, planning, governance, readiness, incident_response, dfir, evidence, forensics | hits: 0
No direct evidence hits for this query.
DFIR-Q-005 - chain-of-custody template evidence owner review log ticket runbook timeline
tags: preparation, planning, governance, readiness, incident_response, dfir, evidence, forensics | hits: 0
No direct evidence hits for this query.
DFIR-Q-009 - edr telemetry evidence evidence owner review log ticket runbook timeline
tags: detection, analysis, triage, telemetry, incident_response, dfir, readiness, logging, monitoring, evidence, forensics | hits: 0
No direct evidence hits for this query.
DFIR-Q-010 - siem alert triage logs evidence owner review log ticket runbook timeline
tags: detection, analysis, triage, telemetry, incident_response, dfir, readiness, logging, monitoring | hits: 0
No direct evidence hits for this query.
DFIR-Q-011 - incident classification records evidence owner review log ticket runbook timeline
tags: detection, analysis, triage, telemetry, incident_response, dfir, readiness | hits: 0
No direct evidence hits for this query.
DFIR-Q-015 - logging retention policy evidence owner review log ticket runbook timeline
tags: detection, analysis, triage, telemetry, incident_response, dfir, readiness, logging, monitoring | hits: 0
No direct evidence hits for this query.
DFIR-Q-016 - admin account monitoring records evidence owner review log ticket runbook timeline
tags: detection, analysis, triage, telemetry, incident_response, dfir, readiness, privileged_access | hits: 0
No direct evidence hits for this query.
DFIR-020 - DetectionAnalysis readiness control 06
gap | severity 1 | evidence_count 0
Ensure DetectionAnalysis procedures are documented, exercised, and reproducible for incident response readiness.
Expected evidence: Policy/procedure artifact showing ownership and cadence for DetectionAnalysis.; Operational records (logs, tickets, reports, or runbooks) demonstrating DetectionAnalysis execution.; Review evidence with remediation tracking for DetectionAnalysis exceptions.
DFIR-Q-005 - chain-of-custody template evidence owner review log ticket runbook timeline
tags: preparation, planning, governance, readiness, incident_response, dfir, evidence, forensics | hits: 0
No direct evidence hits for this query.
DFIR-Q-006 - escalation matrix evidence owner review log ticket runbook timeline
tags: preparation, planning, governance, readiness, incident_response, dfir | hits: 0
No direct evidence hits for this query.
DFIR-Q-009 - edr telemetry evidence evidence owner review log ticket runbook timeline
tags: detection, analysis, triage, telemetry, incident_response, dfir, readiness, logging, monitoring, evidence, forensics | hits: 0
No direct evidence hits for this query.
DFIR-Q-010 - siem alert triage logs evidence owner review log ticket runbook timeline
tags: detection, analysis, triage, telemetry, incident_response, dfir, readiness, logging, monitoring | hits: 0
No direct evidence hits for this query.
DFIR-Q-011 - incident classification records evidence owner review log ticket runbook timeline
tags: detection, analysis, triage, telemetry, incident_response, dfir, readiness | hits: 0
No direct evidence hits for this query.
DFIR-Q-016 - admin account monitoring records evidence owner review log ticket runbook timeline
tags: detection, analysis, triage, telemetry, incident_response, dfir, readiness, privileged_access | hits: 0
No direct evidence hits for this query.
DFIR-021 - DetectionAnalysis readiness control 07
gap | severity 2 | evidence_count 0
Ensure DetectionAnalysis procedures are documented, exercised, and reproducible for incident response readiness.
Expected evidence: Policy/procedure artifact showing ownership and cadence for DetectionAnalysis.; Operational records (logs, tickets, reports, or runbooks) demonstrating DetectionAnalysis execution.; Review evidence with remediation tracking for DetectionAnalysis exceptions.
DFIR-Q-006 - escalation matrix evidence owner review log ticket runbook timeline
tags: preparation, planning, governance, readiness, incident_response, dfir | hits: 0
No direct evidence hits for this query.
DFIR-Q-007 - training exercise records evidence owner review log ticket runbook timeline
tags: preparation, planning, governance, readiness, incident_response, dfir | hits: 0
No direct evidence hits for this query.
DFIR-Q-009 - edr telemetry evidence evidence owner review log ticket runbook timeline
tags: detection, analysis, triage, telemetry, incident_response, dfir, readiness, logging, monitoring, evidence, forensics | hits: 0
No direct evidence hits for this query.
DFIR-Q-010 - siem alert triage logs evidence owner review log ticket runbook timeline
tags: detection, analysis, triage, telemetry, incident_response, dfir, readiness, logging, monitoring | hits: 0
No direct evidence hits for this query.
DFIR-Q-011 - incident classification records evidence owner review log ticket runbook timeline
tags: detection, analysis, triage, telemetry, incident_response, dfir, readiness | hits: 0
No direct evidence hits for this query.
DFIR-Q-012 - forensic timeline notes evidence owner review log ticket runbook timeline
tags: detection, analysis, triage, telemetry, incident_response, dfir, readiness | hits: 0
No direct evidence hits for this query.
DFIR-Q-016 - admin account monitoring records evidence owner review log ticket runbook timeline
tags: detection, analysis, triage, telemetry, incident_response, dfir, readiness, privileged_access | hits: 0
No direct evidence hits for this query.
DFIR-022 - DetectionAnalysis readiness control 08
gap | severity 3 | evidence_count 0
Ensure DetectionAnalysis procedures are documented, exercised, and reproducible for incident response readiness.
Expected evidence: Policy/procedure artifact showing ownership and cadence for DetectionAnalysis.; Operational records (logs, tickets, reports, or runbooks) demonstrating DetectionAnalysis execution.; Review evidence with remediation tracking for DetectionAnalysis exceptions.
DFIR-Q-007 - training exercise records evidence owner review log ticket runbook timeline
tags: preparation, planning, governance, readiness, incident_response, dfir | hits: 0
No direct evidence hits for this query.
DFIR-Q-008 - tabletop outcomes evidence owner review log ticket runbook timeline
tags: preparation, planning, governance, readiness, incident_response, dfir | hits: 0
No direct evidence hits for this query.
DFIR-Q-010 - siem alert triage logs evidence owner review log ticket runbook timeline
tags: detection, analysis, triage, telemetry, incident_response, dfir, readiness, logging, monitoring | hits: 0
No direct evidence hits for this query.
DFIR-Q-011 - incident classification records evidence owner review log ticket runbook timeline
tags: detection, analysis, triage, telemetry, incident_response, dfir, readiness | hits: 0
No direct evidence hits for this query.
DFIR-Q-012 - forensic timeline notes evidence owner review log ticket runbook timeline
tags: detection, analysis, triage, telemetry, incident_response, dfir, readiness | hits: 0
No direct evidence hits for this query.
DFIR-023 - DetectionAnalysis readiness control 09
gap | severity 4 | evidence_count 0
Ensure DetectionAnalysis procedures are documented, exercised, and reproducible for incident response readiness.
Expected evidence: Policy/procedure artifact showing ownership and cadence for DetectionAnalysis.; Operational records (logs, tickets, reports, or runbooks) demonstrating DetectionAnalysis execution.; Review evidence with remediation tracking for DetectionAnalysis exceptions.
DFIR-Q-008 - tabletop outcomes evidence owner review log ticket runbook timeline
tags: preparation, planning, governance, readiness, incident_response, dfir | hits: 0
No direct evidence hits for this query.
DFIR-Q-010 - siem alert triage logs evidence owner review log ticket runbook timeline
tags: detection, analysis, triage, telemetry, incident_response, dfir, readiness, logging, monitoring | hits: 0
No direct evidence hits for this query.
DFIR-Q-011 - incident classification records evidence owner review log ticket runbook timeline
tags: detection, analysis, triage, telemetry, incident_response, dfir, readiness | hits: 0
No direct evidence hits for this query.
DFIR-Q-012 - forensic timeline notes evidence owner review log ticket runbook timeline
tags: detection, analysis, triage, telemetry, incident_response, dfir, readiness | hits: 0
No direct evidence hits for this query.
DFIR-Q-013 - ioc tracking artifacts evidence owner review log ticket runbook timeline
tags: detection, analysis, triage, telemetry, incident_response, dfir, readiness | hits: 0
No direct evidence hits for this query.
DFIR-024 - DetectionAnalysis readiness control 10
gap | severity 5 | evidence_count 0
Ensure DetectionAnalysis procedures are documented, exercised, and reproducible for incident response readiness.
Expected evidence: Policy/procedure artifact showing ownership and cadence for DetectionAnalysis.; Operational records (logs, tickets, reports, or runbooks) demonstrating DetectionAnalysis execution.; Review evidence with remediation tracking for DetectionAnalysis exceptions.
DFIR-Q-011 - incident classification records evidence owner review log ticket runbook timeline
tags: detection, analysis, triage, telemetry, incident_response, dfir, readiness | hits: 0
No direct evidence hits for this query.
DFIR-Q-012 - forensic timeline notes evidence owner review log ticket runbook timeline
tags: detection, analysis, triage, telemetry, incident_response, dfir, readiness | hits: 0
No direct evidence hits for this query.
DFIR-Q-013 - ioc tracking artifacts evidence owner review log ticket runbook timeline
tags: detection, analysis, triage, telemetry, incident_response, dfir, readiness | hits: 0
No direct evidence hits for this query.
DFIR-025 - DetectionAnalysis readiness control 11
gap | severity 1 | evidence_count 0
Ensure DetectionAnalysis procedures are documented, exercised, and reproducible for incident response readiness.
Expected evidence: Policy/procedure artifact showing ownership and cadence for DetectionAnalysis.; Operational records (logs, tickets, reports, or runbooks) demonstrating DetectionAnalysis execution.; Review evidence with remediation tracking for DetectionAnalysis exceptions.
DFIR-Q-011 - incident classification records evidence owner review log ticket runbook timeline
tags: detection, analysis, triage, telemetry, incident_response, dfir, readiness | hits: 0
No direct evidence hits for this query.
DFIR-Q-012 - forensic timeline notes evidence owner review log ticket runbook timeline
tags: detection, analysis, triage, telemetry, incident_response, dfir, readiness | hits: 0
No direct evidence hits for this query.
DFIR-Q-013 - ioc tracking artifacts evidence owner review log ticket runbook timeline
tags: detection, analysis, triage, telemetry, incident_response, dfir, readiness | hits: 0
No direct evidence hits for this query.
DFIR-Q-014 - time sync ntp evidence evidence owner review log ticket runbook timeline
tags: detection, analysis, triage, telemetry, incident_response, dfir, readiness, evidence, forensics, time_sync | hits: 0
No direct evidence hits for this query.
DFIR-026 - DetectionAnalysis readiness control 12
gap | severity 2 | evidence_count 0
Ensure DetectionAnalysis procedures are documented, exercised, and reproducible for incident response readiness.
Expected evidence: Policy/procedure artifact showing ownership and cadence for DetectionAnalysis.; Operational records (logs, tickets, reports, or runbooks) demonstrating DetectionAnalysis execution.; Review evidence with remediation tracking for DetectionAnalysis exceptions.
DFIR-Q-012 - forensic timeline notes evidence owner review log ticket runbook timeline
tags: detection, analysis, triage, telemetry, incident_response, dfir, readiness | hits: 0
No direct evidence hits for this query.
DFIR-Q-013 - ioc tracking artifacts evidence owner review log ticket runbook timeline
tags: detection, analysis, triage, telemetry, incident_response, dfir, readiness | hits: 0
No direct evidence hits for this query.
DFIR-Q-014 - time sync ntp evidence evidence owner review log ticket runbook timeline
tags: detection, analysis, triage, telemetry, incident_response, dfir, readiness, evidence, forensics, time_sync | hits: 0
No direct evidence hits for this query.
DFIR-027 - DetectionAnalysis readiness control 13
gap | severity 3 | evidence_count 0
Ensure DetectionAnalysis procedures are documented, exercised, and reproducible for incident response readiness.
Expected evidence: Policy/procedure artifact showing ownership and cadence for DetectionAnalysis.; Operational records (logs, tickets, reports, or runbooks) demonstrating DetectionAnalysis execution.; Review evidence with remediation tracking for DetectionAnalysis exceptions.
DFIR-Q-012 - forensic timeline notes evidence owner review log ticket runbook timeline
tags: detection, analysis, triage, telemetry, incident_response, dfir, readiness | hits: 0
No direct evidence hits for this query.
DFIR-Q-013 - ioc tracking artifacts evidence owner review log ticket runbook timeline
tags: detection, analysis, triage, telemetry, incident_response, dfir, readiness | hits: 0
No direct evidence hits for this query.
DFIR-Q-014 - time sync ntp evidence evidence owner review log ticket runbook timeline
tags: detection, analysis, triage, telemetry, incident_response, dfir, readiness, evidence, forensics, time_sync | hits: 0
No direct evidence hits for this query.
DFIR-Q-015 - logging retention policy evidence owner review log ticket runbook timeline
tags: detection, analysis, triage, telemetry, incident_response, dfir, readiness, logging, monitoring | hits: 0
No direct evidence hits for this query.
DFIR-028 - DetectionAnalysis readiness control 14
gap | severity 4 | evidence_count 0
Ensure DetectionAnalysis procedures are documented, exercised, and reproducible for incident response readiness.
Expected evidence: Policy/procedure artifact showing ownership and cadence for DetectionAnalysis.; Operational records (logs, tickets, reports, or runbooks) demonstrating DetectionAnalysis execution.; Review evidence with remediation tracking for DetectionAnalysis exceptions.
DFIR-Q-013 - ioc tracking artifacts evidence owner review log ticket runbook timeline
tags: detection, analysis, triage, telemetry, incident_response, dfir, readiness | hits: 0
No direct evidence hits for this query.
DFIR-Q-014 - time sync ntp evidence evidence owner review log ticket runbook timeline
tags: detection, analysis, triage, telemetry, incident_response, dfir, readiness, evidence, forensics, time_sync | hits: 0
No direct evidence hits for this query.
DFIR-Q-015 - logging retention policy evidence owner review log ticket runbook timeline
tags: detection, analysis, triage, telemetry, incident_response, dfir, readiness, logging, monitoring | hits: 0
No direct evidence hits for this query.
DFIR-029 - Containment readiness control 01
gap | severity 1 | evidence_count 0
Ensure Containment procedures are documented, exercised, and reproducible for incident response readiness.
Expected evidence: Policy/procedure artifact showing ownership and cadence for Containment.; Operational records (logs, tickets, reports, or runbooks) demonstrating Containment execution.; Review evidence with remediation tracking for Containment exceptions.
DFIR-Q-009 - edr telemetry evidence evidence owner review log ticket runbook timeline
tags: detection, analysis, triage, telemetry, incident_response, dfir, readiness, logging, monitoring, evidence, forensics | hits: 0
No direct evidence hits for this query.
DFIR-Q-017 - host isolation records evidence owner review log ticket runbook timeline
tags: containment, isolation, segmentation, response, incident_response, dfir, readiness | hits: 0
No direct evidence hits for this query.
DFIR-Q-021 - privileged account disablement evidence owner review log ticket runbook timeline
tags: containment, isolation, segmentation, response, incident_response, dfir, readiness, privileged_access | hits: 0
No direct evidence hits for this query.
DFIR-Q-022 - endpoint quarantine actions evidence owner review log ticket runbook timeline
tags: containment, isolation, segmentation, response, incident_response, dfir, readiness | hits: 0
No direct evidence hits for this query.
DFIR-Q-023 - containment approval trail evidence owner review log ticket runbook timeline
tags: containment, isolation, segmentation, response, incident_response, dfir, readiness | hits: 0
No direct evidence hits for this query.
DFIR-Q-024 - containment verification checks evidence owner review log ticket runbook timeline
tags: containment, isolation, segmentation, response, incident_response, dfir, readiness | hits: 0
No direct evidence hits for this query.
DFIR-030 - Containment readiness control 02
gap | severity 2 | evidence_count 0
Ensure Containment procedures are documented, exercised, and reproducible for incident response readiness.
Expected evidence: Policy/procedure artifact showing ownership and cadence for Containment.; Operational records (logs, tickets, reports, or runbooks) demonstrating Containment execution.; Review evidence with remediation tracking for Containment exceptions.
DFIR-Q-009 - edr telemetry evidence evidence owner review log ticket runbook timeline
tags: detection, analysis, triage, telemetry, incident_response, dfir, readiness, logging, monitoring, evidence, forensics | hits: 0
No direct evidence hits for this query.
DFIR-Q-010 - siem alert triage logs evidence owner review log ticket runbook timeline
tags: detection, analysis, triage, telemetry, incident_response, dfir, readiness, logging, monitoring | hits: 0
No direct evidence hits for this query.
DFIR-Q-017 - host isolation records evidence owner review log ticket runbook timeline
tags: containment, isolation, segmentation, response, incident_response, dfir, readiness | hits: 0
No direct evidence hits for this query.
DFIR-Q-022 - endpoint quarantine actions evidence owner review log ticket runbook timeline
tags: containment, isolation, segmentation, response, incident_response, dfir, readiness | hits: 0
No direct evidence hits for this query.
DFIR-Q-023 - containment approval trail evidence owner review log ticket runbook timeline
tags: containment, isolation, segmentation, response, incident_response, dfir, readiness | hits: 0
No direct evidence hits for this query.
DFIR-Q-024 - containment verification checks evidence owner review log ticket runbook timeline
tags: containment, isolation, segmentation, response, incident_response, dfir, readiness | hits: 0
No direct evidence hits for this query.
DFIR-031 - Containment readiness control 03
gap | severity 3 | evidence_count 0
Ensure Containment procedures are documented, exercised, and reproducible for incident response readiness.
Expected evidence: Policy/procedure artifact showing ownership and cadence for Containment.; Operational records (logs, tickets, reports, or runbooks) demonstrating Containment execution.; Review evidence with remediation tracking for Containment exceptions.
DFIR-Q-010 - siem alert triage logs evidence owner review log ticket runbook timeline
tags: detection, analysis, triage, telemetry, incident_response, dfir, readiness, logging, monitoring | hits: 0
No direct evidence hits for this query.
DFIR-Q-011 - incident classification records evidence owner review log ticket runbook timeline
tags: detection, analysis, triage, telemetry, incident_response, dfir, readiness | hits: 0
No direct evidence hits for this query.
DFIR-Q-017 - host isolation records evidence owner review log ticket runbook timeline
tags: containment, isolation, segmentation, response, incident_response, dfir, readiness | hits: 0
No direct evidence hits for this query.
DFIR-Q-018 - network segmentation indicators evidence owner review log ticket runbook timeline
tags: containment, isolation, segmentation, response, incident_response, dfir, readiness | hits: 0
No direct evidence hits for this query.
DFIR-Q-022 - endpoint quarantine actions evidence owner review log ticket runbook timeline
tags: containment, isolation, segmentation, response, incident_response, dfir, readiness | hits: 0
No direct evidence hits for this query.
DFIR-Q-023 - containment approval trail evidence owner review log ticket runbook timeline
tags: containment, isolation, segmentation, response, incident_response, dfir, readiness | hits: 0
No direct evidence hits for this query.
DFIR-Q-024 - containment verification checks evidence owner review log ticket runbook timeline
tags: containment, isolation, segmentation, response, incident_response, dfir, readiness | hits: 0
No direct evidence hits for this query.
DFIR-032 - Containment readiness control 04
gap | severity 4 | evidence_count 0
Ensure Containment procedures are documented, exercised, and reproducible for incident response readiness.
Expected evidence: Policy/procedure artifact showing ownership and cadence for Containment.; Operational records (logs, tickets, reports, or runbooks) demonstrating Containment execution.; Review evidence with remediation tracking for Containment exceptions.
DFIR-Q-011 - incident classification records evidence owner review log ticket runbook timeline
tags: detection, analysis, triage, telemetry, incident_response, dfir, readiness | hits: 0
No direct evidence hits for this query.
DFIR-Q-012 - forensic timeline notes evidence owner review log ticket runbook timeline
tags: detection, analysis, triage, telemetry, incident_response, dfir, readiness | hits: 0
No direct evidence hits for this query.
DFIR-Q-017 - host isolation records evidence owner review log ticket runbook timeline
tags: containment, isolation, segmentation, response, incident_response, dfir, readiness | hits: 0
No direct evidence hits for this query.
DFIR-Q-018 - network segmentation indicators evidence owner review log ticket runbook timeline
tags: containment, isolation, segmentation, response, incident_response, dfir, readiness | hits: 0
No direct evidence hits for this query.
DFIR-Q-023 - containment approval trail evidence owner review log ticket runbook timeline
tags: containment, isolation, segmentation, response, incident_response, dfir, readiness | hits: 0
No direct evidence hits for this query.
DFIR-Q-024 - containment verification checks evidence owner review log ticket runbook timeline
tags: containment, isolation, segmentation, response, incident_response, dfir, readiness | hits: 0
No direct evidence hits for this query.
DFIR-033 - Containment readiness control 05
gap | severity 5 | evidence_count 0
Ensure Containment procedures are documented, exercised, and reproducible for incident response readiness.
Expected evidence: Policy/procedure artifact showing ownership and cadence for Containment.; Operational records (logs, tickets, reports, or runbooks) demonstrating Containment execution.; Review evidence with remediation tracking for Containment exceptions.
DFIR-Q-012 - forensic timeline notes evidence owner review log ticket runbook timeline
tags: detection, analysis, triage, telemetry, incident_response, dfir, readiness | hits: 0
No direct evidence hits for this query.
DFIR-Q-013 - ioc tracking artifacts evidence owner review log ticket runbook timeline
tags: detection, analysis, triage, telemetry, incident_response, dfir, readiness | hits: 0
No direct evidence hits for this query.
DFIR-Q-017 - host isolation records evidence owner review log ticket runbook timeline
tags: containment, isolation, segmentation, response, incident_response, dfir, readiness | hits: 0
No direct evidence hits for this query.
DFIR-Q-018 - network segmentation indicators evidence owner review log ticket runbook timeline
tags: containment, isolation, segmentation, response, incident_response, dfir, readiness | hits: 0
No direct evidence hits for this query.
DFIR-Q-019 - access revocation logs evidence owner review log ticket runbook timeline
tags: containment, isolation, segmentation, response, incident_response, dfir, readiness | hits: 0
No direct evidence hits for this query.
DFIR-Q-023 - containment approval trail evidence owner review log ticket runbook timeline
tags: containment, isolation, segmentation, response, incident_response, dfir, readiness | hits: 0
No direct evidence hits for this query.
DFIR-Q-024 - containment verification checks evidence owner review log ticket runbook timeline
tags: containment, isolation, segmentation, response, incident_response, dfir, readiness | hits: 0
No direct evidence hits for this query.
DFIR-034 - Containment readiness control 06
gap | severity 1 | evidence_count 0
Ensure Containment procedures are documented, exercised, and reproducible for incident response readiness.
Expected evidence: Policy/procedure artifact showing ownership and cadence for Containment.; Operational records (logs, tickets, reports, or runbooks) demonstrating Containment execution.; Review evidence with remediation tracking for Containment exceptions.
DFIR-Q-013 - ioc tracking artifacts evidence owner review log ticket runbook timeline
tags: detection, analysis, triage, telemetry, incident_response, dfir, readiness | hits: 0
No direct evidence hits for this query.
DFIR-Q-014 - time sync ntp evidence evidence owner review log ticket runbook timeline
tags: detection, analysis, triage, telemetry, incident_response, dfir, readiness, evidence, forensics, time_sync | hits: 0
No direct evidence hits for this query.
DFIR-Q-017 - host isolation records evidence owner review log ticket runbook timeline
tags: containment, isolation, segmentation, response, incident_response, dfir, readiness | hits: 0
No direct evidence hits for this query.
DFIR-Q-018 - network segmentation indicators evidence owner review log ticket runbook timeline
tags: containment, isolation, segmentation, response, incident_response, dfir, readiness | hits: 0
No direct evidence hits for this query.
DFIR-Q-019 - access revocation logs evidence owner review log ticket runbook timeline
tags: containment, isolation, segmentation, response, incident_response, dfir, readiness | hits: 0
No direct evidence hits for this query.
DFIR-Q-024 - containment verification checks evidence owner review log ticket runbook timeline
tags: containment, isolation, segmentation, response, incident_response, dfir, readiness | hits: 0
No direct evidence hits for this query.
DFIR-035 - Containment readiness control 07
gap | severity 2 | evidence_count 0
Ensure Containment procedures are documented, exercised, and reproducible for incident response readiness.
Expected evidence: Policy/procedure artifact showing ownership and cadence for Containment.; Operational records (logs, tickets, reports, or runbooks) demonstrating Containment execution.; Review evidence with remediation tracking for Containment exceptions.
DFIR-Q-014 - time sync ntp evidence evidence owner review log ticket runbook timeline
tags: detection, analysis, triage, telemetry, incident_response, dfir, readiness, evidence, forensics, time_sync | hits: 0
No direct evidence hits for this query.
DFIR-Q-015 - logging retention policy evidence owner review log ticket runbook timeline
tags: detection, analysis, triage, telemetry, incident_response, dfir, readiness, logging, monitoring | hits: 0
No direct evidence hits for this query.
DFIR-Q-017 - host isolation records evidence owner review log ticket runbook timeline
tags: containment, isolation, segmentation, response, incident_response, dfir, readiness | hits: 0
No direct evidence hits for this query.
DFIR-Q-018 - network segmentation indicators evidence owner review log ticket runbook timeline
tags: containment, isolation, segmentation, response, incident_response, dfir, readiness | hits: 0
No direct evidence hits for this query.
DFIR-Q-019 - access revocation logs evidence owner review log ticket runbook timeline
tags: containment, isolation, segmentation, response, incident_response, dfir, readiness | hits: 0
No direct evidence hits for this query.
DFIR-Q-020 - temporary firewall changes evidence owner review log ticket runbook timeline
tags: containment, isolation, segmentation, response, incident_response, dfir, readiness, change_management | hits: 0
No direct evidence hits for this query.
DFIR-Q-024 - containment verification checks evidence owner review log ticket runbook timeline
tags: containment, isolation, segmentation, response, incident_response, dfir, readiness | hits: 0
No direct evidence hits for this query.
DFIR-036 - Containment readiness control 08
gap | severity 3 | evidence_count 0
Ensure Containment procedures are documented, exercised, and reproducible for incident response readiness.
Expected evidence: Policy/procedure artifact showing ownership and cadence for Containment.; Operational records (logs, tickets, reports, or runbooks) demonstrating Containment execution.; Review evidence with remediation tracking for Containment exceptions.
DFIR-Q-015 - logging retention policy evidence owner review log ticket runbook timeline
tags: detection, analysis, triage, telemetry, incident_response, dfir, readiness, logging, monitoring | hits: 0
No direct evidence hits for this query.
DFIR-Q-016 - admin account monitoring records evidence owner review log ticket runbook timeline
tags: detection, analysis, triage, telemetry, incident_response, dfir, readiness, privileged_access | hits: 0
No direct evidence hits for this query.
DFIR-Q-018 - network segmentation indicators evidence owner review log ticket runbook timeline
tags: containment, isolation, segmentation, response, incident_response, dfir, readiness | hits: 0
No direct evidence hits for this query.
DFIR-Q-019 - access revocation logs evidence owner review log ticket runbook timeline
tags: containment, isolation, segmentation, response, incident_response, dfir, readiness | hits: 0
No direct evidence hits for this query.
DFIR-Q-020 - temporary firewall changes evidence owner review log ticket runbook timeline
tags: containment, isolation, segmentation, response, incident_response, dfir, readiness, change_management | hits: 0
No direct evidence hits for this query.
DFIR-037 - Containment readiness control 09
gap | severity 4 | evidence_count 0
Ensure Containment procedures are documented, exercised, and reproducible for incident response readiness.
Expected evidence: Policy/procedure artifact showing ownership and cadence for Containment.; Operational records (logs, tickets, reports, or runbooks) demonstrating Containment execution.; Review evidence with remediation tracking for Containment exceptions.
DFIR-Q-016 - admin account monitoring records evidence owner review log ticket runbook timeline
tags: detection, analysis, triage, telemetry, incident_response, dfir, readiness, privileged_access | hits: 0
No direct evidence hits for this query.
DFIR-Q-018 - network segmentation indicators evidence owner review log ticket runbook timeline
tags: containment, isolation, segmentation, response, incident_response, dfir, readiness | hits: 0
No direct evidence hits for this query.
DFIR-Q-019 - access revocation logs evidence owner review log ticket runbook timeline
tags: containment, isolation, segmentation, response, incident_response, dfir, readiness | hits: 0
No direct evidence hits for this query.
DFIR-Q-020 - temporary firewall changes evidence owner review log ticket runbook timeline
tags: containment, isolation, segmentation, response, incident_response, dfir, readiness, change_management | hits: 0
No direct evidence hits for this query.
DFIR-Q-021 - privileged account disablement evidence owner review log ticket runbook timeline
tags: containment, isolation, segmentation, response, incident_response, dfir, readiness, privileged_access | hits: 0
No direct evidence hits for this query.
DFIR-038 - Containment readiness control 10
gap | severity 5 | evidence_count 0
Ensure Containment procedures are documented, exercised, and reproducible for incident response readiness.
Expected evidence: Policy/procedure artifact showing ownership and cadence for Containment.; Operational records (logs, tickets, reports, or runbooks) demonstrating Containment execution.; Review evidence with remediation tracking for Containment exceptions.
DFIR-Q-019 - access revocation logs evidence owner review log ticket runbook timeline
tags: containment, isolation, segmentation, response, incident_response, dfir, readiness | hits: 0
No direct evidence hits for this query.
DFIR-Q-020 - temporary firewall changes evidence owner review log ticket runbook timeline
tags: containment, isolation, segmentation, response, incident_response, dfir, readiness, change_management | hits: 0
No direct evidence hits for this query.
DFIR-Q-021 - privileged account disablement evidence owner review log ticket runbook timeline
tags: containment, isolation, segmentation, response, incident_response, dfir, readiness, privileged_access | hits: 0
No direct evidence hits for this query.
DFIR-039 - Containment readiness control 11
gap | severity 1 | evidence_count 0
Ensure Containment procedures are documented, exercised, and reproducible for incident response readiness.
Expected evidence: Policy/procedure artifact showing ownership and cadence for Containment.; Operational records (logs, tickets, reports, or runbooks) demonstrating Containment execution.; Review evidence with remediation tracking for Containment exceptions.
DFIR-Q-019 - access revocation logs evidence owner review log ticket runbook timeline
tags: containment, isolation, segmentation, response, incident_response, dfir, readiness | hits: 0
No direct evidence hits for this query.
DFIR-Q-020 - temporary firewall changes evidence owner review log ticket runbook timeline
tags: containment, isolation, segmentation, response, incident_response, dfir, readiness, change_management | hits: 0
No direct evidence hits for this query.
DFIR-Q-021 - privileged account disablement evidence owner review log ticket runbook timeline
tags: containment, isolation, segmentation, response, incident_response, dfir, readiness, privileged_access | hits: 0
No direct evidence hits for this query.
DFIR-Q-022 - endpoint quarantine actions evidence owner review log ticket runbook timeline
tags: containment, isolation, segmentation, response, incident_response, dfir, readiness | hits: 0
No direct evidence hits for this query.
DFIR-040 - Containment readiness control 12
gap | severity 2 | evidence_count 0
Ensure Containment procedures are documented, exercised, and reproducible for incident response readiness.
Expected evidence: Policy/procedure artifact showing ownership and cadence for Containment.; Operational records (logs, tickets, reports, or runbooks) demonstrating Containment execution.; Review evidence with remediation tracking for Containment exceptions.
DFIR-Q-020 - temporary firewall changes evidence owner review log ticket runbook timeline
tags: containment, isolation, segmentation, response, incident_response, dfir, readiness, change_management | hits: 0
No direct evidence hits for this query.
DFIR-Q-021 - privileged account disablement evidence owner review log ticket runbook timeline
tags: containment, isolation, segmentation, response, incident_response, dfir, readiness, privileged_access | hits: 0
No direct evidence hits for this query.
DFIR-Q-022 - endpoint quarantine actions evidence owner review log ticket runbook timeline
tags: containment, isolation, segmentation, response, incident_response, dfir, readiness | hits: 0
No direct evidence hits for this query.
DFIR-041 - Containment readiness control 13
gap | severity 3 | evidence_count 0
Ensure Containment procedures are documented, exercised, and reproducible for incident response readiness.
Expected evidence: Policy/procedure artifact showing ownership and cadence for Containment.; Operational records (logs, tickets, reports, or runbooks) demonstrating Containment execution.; Review evidence with remediation tracking for Containment exceptions.
DFIR-Q-020 - temporary firewall changes evidence owner review log ticket runbook timeline
tags: containment, isolation, segmentation, response, incident_response, dfir, readiness, change_management | hits: 0
No direct evidence hits for this query.
DFIR-Q-021 - privileged account disablement evidence owner review log ticket runbook timeline
tags: containment, isolation, segmentation, response, incident_response, dfir, readiness, privileged_access | hits: 0
No direct evidence hits for this query.
DFIR-Q-022 - endpoint quarantine actions evidence owner review log ticket runbook timeline
tags: containment, isolation, segmentation, response, incident_response, dfir, readiness | hits: 0
No direct evidence hits for this query.
DFIR-Q-023 - containment approval trail evidence owner review log ticket runbook timeline
tags: containment, isolation, segmentation, response, incident_response, dfir, readiness | hits: 0
No direct evidence hits for this query.
DFIR-042 - Containment readiness control 14
gap | severity 4 | evidence_count 0
Ensure Containment procedures are documented, exercised, and reproducible for incident response readiness.
Expected evidence: Policy/procedure artifact showing ownership and cadence for Containment.; Operational records (logs, tickets, reports, or runbooks) demonstrating Containment execution.; Review evidence with remediation tracking for Containment exceptions.
DFIR-Q-021 - privileged account disablement evidence owner review log ticket runbook timeline
tags: containment, isolation, segmentation, response, incident_response, dfir, readiness, privileged_access | hits: 0
No direct evidence hits for this query.
DFIR-Q-022 - endpoint quarantine actions evidence owner review log ticket runbook timeline
tags: containment, isolation, segmentation, response, incident_response, dfir, readiness | hits: 0
No direct evidence hits for this query.
DFIR-Q-023 - containment approval trail evidence owner review log ticket runbook timeline
tags: containment, isolation, segmentation, response, incident_response, dfir, readiness | hits: 0
No direct evidence hits for this query.
DFIR-043 - Eradication readiness control 01
gap | severity 1 | evidence_count 0
Ensure Eradication procedures are documented, exercised, and reproducible for incident response readiness.
Expected evidence: Policy/procedure artifact showing ownership and cadence for Eradication.; Operational records (logs, tickets, reports, or runbooks) demonstrating Eradication execution.; Review evidence with remediation tracking for Eradication exceptions.
DFIR-Q-017 - host isolation records evidence owner review log ticket runbook timeline
tags: containment, isolation, segmentation, response, incident_response, dfir, readiness | hits: 0
No direct evidence hits for this query.
DFIR-Q-025 - malware removal evidence evidence owner review log ticket runbook timeline
tags: eradication, remediation, patching, hardening, incident_response, dfir, readiness, evidence, forensics | hits: 0
No direct evidence hits for this query.
DFIR-Q-029 - vulnerability closure notes evidence owner review log ticket runbook timeline
tags: eradication, remediation, patching, hardening, incident_response, dfir, readiness | hits: 0
No direct evidence hits for this query.
DFIR-Q-030 - persistence hunting artifacts evidence owner review log ticket runbook timeline
tags: eradication, remediation, patching, hardening, incident_response, dfir, readiness | hits: 0
No direct evidence hits for this query.
DFIR-Q-031 - root cause remediation tickets evidence owner review log ticket runbook timeline
tags: eradication, remediation, patching, hardening, incident_response, dfir, readiness | hits: 0
No direct evidence hits for this query.
DFIR-Q-032 - change management records evidence owner review log ticket runbook timeline
tags: eradication, remediation, patching, hardening, incident_response, dfir, readiness, change_management | hits: 0
No direct evidence hits for this query.
DFIR-044 - Eradication readiness control 02
gap | severity 2 | evidence_count 0
Ensure Eradication procedures are documented, exercised, and reproducible for incident response readiness.
Expected evidence: Policy/procedure artifact showing ownership and cadence for Eradication.; Operational records (logs, tickets, reports, or runbooks) demonstrating Eradication execution.; Review evidence with remediation tracking for Eradication exceptions.
DFIR-Q-017 - host isolation records evidence owner review log ticket runbook timeline
tags: containment, isolation, segmentation, response, incident_response, dfir, readiness | hits: 0
No direct evidence hits for this query.
DFIR-Q-018 - network segmentation indicators evidence owner review log ticket runbook timeline
tags: containment, isolation, segmentation, response, incident_response, dfir, readiness | hits: 0
No direct evidence hits for this query.
DFIR-Q-025 - malware removal evidence evidence owner review log ticket runbook timeline
tags: eradication, remediation, patching, hardening, incident_response, dfir, readiness, evidence, forensics | hits: 0
No direct evidence hits for this query.
DFIR-Q-030 - persistence hunting artifacts evidence owner review log ticket runbook timeline
tags: eradication, remediation, patching, hardening, incident_response, dfir, readiness | hits: 0
No direct evidence hits for this query.
DFIR-Q-031 - root cause remediation tickets evidence owner review log ticket runbook timeline
tags: eradication, remediation, patching, hardening, incident_response, dfir, readiness | hits: 0
No direct evidence hits for this query.
DFIR-Q-032 - change management records evidence owner review log ticket runbook timeline
tags: eradication, remediation, patching, hardening, incident_response, dfir, readiness, change_management | hits: 0
No direct evidence hits for this query.
DFIR-045 - Eradication readiness control 03
gap | severity 3 | evidence_count 0
Ensure Eradication procedures are documented, exercised, and reproducible for incident response readiness.
Expected evidence: Policy/procedure artifact showing ownership and cadence for Eradication.; Operational records (logs, tickets, reports, or runbooks) demonstrating Eradication execution.; Review evidence with remediation tracking for Eradication exceptions.
DFIR-Q-018 - network segmentation indicators evidence owner review log ticket runbook timeline
tags: containment, isolation, segmentation, response, incident_response, dfir, readiness | hits: 0
No direct evidence hits for this query.
DFIR-Q-019 - access revocation logs evidence owner review log ticket runbook timeline
tags: containment, isolation, segmentation, response, incident_response, dfir, readiness | hits: 0
No direct evidence hits for this query.
DFIR-Q-025 - malware removal evidence evidence owner review log ticket runbook timeline
tags: eradication, remediation, patching, hardening, incident_response, dfir, readiness, evidence, forensics | hits: 0
No direct evidence hits for this query.
DFIR-Q-026 - credential reset evidence evidence owner review log ticket runbook timeline
tags: eradication, remediation, patching, hardening, incident_response, dfir, readiness, evidence, forensics | hits: 0
No direct evidence hits for this query.
DFIR-Q-030 - persistence hunting artifacts evidence owner review log ticket runbook timeline
tags: eradication, remediation, patching, hardening, incident_response, dfir, readiness | hits: 0
No direct evidence hits for this query.
DFIR-Q-031 - root cause remediation tickets evidence owner review log ticket runbook timeline
tags: eradication, remediation, patching, hardening, incident_response, dfir, readiness | hits: 0
No direct evidence hits for this query.
DFIR-Q-032 - change management records evidence owner review log ticket runbook timeline
tags: eradication, remediation, patching, hardening, incident_response, dfir, readiness, change_management | hits: 0
No direct evidence hits for this query.
DFIR-046 - Eradication readiness control 04
gap | severity 4 | evidence_count 0
Ensure Eradication procedures are documented, exercised, and reproducible for incident response readiness.
Expected evidence: Policy/procedure artifact showing ownership and cadence for Eradication.; Operational records (logs, tickets, reports, or runbooks) demonstrating Eradication execution.; Review evidence with remediation tracking for Eradication exceptions.
DFIR-Q-019 - access revocation logs evidence owner review log ticket runbook timeline
tags: containment, isolation, segmentation, response, incident_response, dfir, readiness | hits: 0
No direct evidence hits for this query.
DFIR-Q-020 - temporary firewall changes evidence owner review log ticket runbook timeline
tags: containment, isolation, segmentation, response, incident_response, dfir, readiness, change_management | hits: 0
No direct evidence hits for this query.
DFIR-Q-025 - malware removal evidence evidence owner review log ticket runbook timeline
tags: eradication, remediation, patching, hardening, incident_response, dfir, readiness, evidence, forensics | hits: 0
No direct evidence hits for this query.
DFIR-Q-026 - credential reset evidence evidence owner review log ticket runbook timeline
tags: eradication, remediation, patching, hardening, incident_response, dfir, readiness, evidence, forensics | hits: 0
No direct evidence hits for this query.
DFIR-Q-031 - root cause remediation tickets evidence owner review log ticket runbook timeline
tags: eradication, remediation, patching, hardening, incident_response, dfir, readiness | hits: 0
No direct evidence hits for this query.
DFIR-Q-032 - change management records evidence owner review log ticket runbook timeline
tags: eradication, remediation, patching, hardening, incident_response, dfir, readiness, change_management | hits: 0
No direct evidence hits for this query.
DFIR-047 - Eradication readiness control 05
gap | severity 5 | evidence_count 0
Ensure Eradication procedures are documented, exercised, and reproducible for incident response readiness.
Expected evidence: Policy/procedure artifact showing ownership and cadence for Eradication.; Operational records (logs, tickets, reports, or runbooks) demonstrating Eradication execution.; Review evidence with remediation tracking for Eradication exceptions.
DFIR-Q-020 - temporary firewall changes evidence owner review log ticket runbook timeline
tags: containment, isolation, segmentation, response, incident_response, dfir, readiness, change_management | hits: 0
No direct evidence hits for this query.
DFIR-Q-021 - privileged account disablement evidence owner review log ticket runbook timeline
tags: containment, isolation, segmentation, response, incident_response, dfir, readiness, privileged_access | hits: 0
No direct evidence hits for this query.
DFIR-Q-025 - malware removal evidence evidence owner review log ticket runbook timeline
tags: eradication, remediation, patching, hardening, incident_response, dfir, readiness, evidence, forensics | hits: 0
No direct evidence hits for this query.
DFIR-Q-026 - credential reset evidence evidence owner review log ticket runbook timeline
tags: eradication, remediation, patching, hardening, incident_response, dfir, readiness, evidence, forensics | hits: 0
No direct evidence hits for this query.
DFIR-Q-027 - patch deployment logs evidence owner review log ticket runbook timeline
tags: eradication, remediation, patching, hardening, incident_response, dfir, readiness | hits: 0
No direct evidence hits for this query.
DFIR-Q-031 - root cause remediation tickets evidence owner review log ticket runbook timeline
tags: eradication, remediation, patching, hardening, incident_response, dfir, readiness | hits: 0
No direct evidence hits for this query.
DFIR-Q-032 - change management records evidence owner review log ticket runbook timeline
tags: eradication, remediation, patching, hardening, incident_response, dfir, readiness, change_management | hits: 0
No direct evidence hits for this query.
DFIR-048 - Eradication readiness control 06
gap | severity 1 | evidence_count 0
Ensure Eradication procedures are documented, exercised, and reproducible for incident response readiness.
Expected evidence: Policy/procedure artifact showing ownership and cadence for Eradication.; Operational records (logs, tickets, reports, or runbooks) demonstrating Eradication execution.; Review evidence with remediation tracking for Eradication exceptions.
DFIR-Q-021 - privileged account disablement evidence owner review log ticket runbook timeline
tags: containment, isolation, segmentation, response, incident_response, dfir, readiness, privileged_access | hits: 0
No direct evidence hits for this query.
DFIR-Q-022 - endpoint quarantine actions evidence owner review log ticket runbook timeline
tags: containment, isolation, segmentation, response, incident_response, dfir, readiness | hits: 0
No direct evidence hits for this query.
DFIR-Q-025 - malware removal evidence evidence owner review log ticket runbook timeline
tags: eradication, remediation, patching, hardening, incident_response, dfir, readiness, evidence, forensics | hits: 0
No direct evidence hits for this query.
DFIR-Q-026 - credential reset evidence evidence owner review log ticket runbook timeline
tags: eradication, remediation, patching, hardening, incident_response, dfir, readiness, evidence, forensics | hits: 0
No direct evidence hits for this query.
DFIR-Q-027 - patch deployment logs evidence owner review log ticket runbook timeline
tags: eradication, remediation, patching, hardening, incident_response, dfir, readiness | hits: 0
No direct evidence hits for this query.
DFIR-Q-032 - change management records evidence owner review log ticket runbook timeline
tags: eradication, remediation, patching, hardening, incident_response, dfir, readiness, change_management | hits: 0
No direct evidence hits for this query.
DFIR-049 - Eradication readiness control 07
gap | severity 2 | evidence_count 0
Ensure Eradication procedures are documented, exercised, and reproducible for incident response readiness.
Expected evidence: Policy/procedure artifact showing ownership and cadence for Eradication.; Operational records (logs, tickets, reports, or runbooks) demonstrating Eradication execution.; Review evidence with remediation tracking for Eradication exceptions.
DFIR-Q-022 - endpoint quarantine actions evidence owner review log ticket runbook timeline
tags: containment, isolation, segmentation, response, incident_response, dfir, readiness | hits: 0
No direct evidence hits for this query.
DFIR-Q-023 - containment approval trail evidence owner review log ticket runbook timeline
tags: containment, isolation, segmentation, response, incident_response, dfir, readiness | hits: 0
No direct evidence hits for this query.
DFIR-Q-025 - malware removal evidence evidence owner review log ticket runbook timeline
tags: eradication, remediation, patching, hardening, incident_response, dfir, readiness, evidence, forensics | hits: 0
No direct evidence hits for this query.
DFIR-Q-026 - credential reset evidence evidence owner review log ticket runbook timeline
tags: eradication, remediation, patching, hardening, incident_response, dfir, readiness, evidence, forensics | hits: 0
No direct evidence hits for this query.
DFIR-Q-027 - patch deployment logs evidence owner review log ticket runbook timeline
tags: eradication, remediation, patching, hardening, incident_response, dfir, readiness | hits: 0
No direct evidence hits for this query.
DFIR-Q-028 - hardening checklist outputs evidence owner review log ticket runbook timeline
tags: eradication, remediation, patching, hardening, incident_response, dfir, readiness | hits: 0
No direct evidence hits for this query.
DFIR-Q-032 - change management records evidence owner review log ticket runbook timeline
tags: eradication, remediation, patching, hardening, incident_response, dfir, readiness, change_management | hits: 0
No direct evidence hits for this query.
DFIR-050 - Eradication readiness control 08
gap | severity 3 | evidence_count 0
Ensure Eradication procedures are documented, exercised, and reproducible for incident response readiness.
Expected evidence: Policy/procedure artifact showing ownership and cadence for Eradication.; Operational records (logs, tickets, reports, or runbooks) demonstrating Eradication execution.; Review evidence with remediation tracking for Eradication exceptions.
DFIR-Q-023 - containment approval trail evidence owner review log ticket runbook timeline
tags: containment, isolation, segmentation, response, incident_response, dfir, readiness | hits: 0
No direct evidence hits for this query.
DFIR-Q-024 - containment verification checks evidence owner review log ticket runbook timeline
tags: containment, isolation, segmentation, response, incident_response, dfir, readiness | hits: 0
No direct evidence hits for this query.
DFIR-Q-026 - credential reset evidence evidence owner review log ticket runbook timeline
tags: eradication, remediation, patching, hardening, incident_response, dfir, readiness, evidence, forensics | hits: 0
No direct evidence hits for this query.
DFIR-Q-027 - patch deployment logs evidence owner review log ticket runbook timeline
tags: eradication, remediation, patching, hardening, incident_response, dfir, readiness | hits: 0
No direct evidence hits for this query.
DFIR-Q-028 - hardening checklist outputs evidence owner review log ticket runbook timeline
tags: eradication, remediation, patching, hardening, incident_response, dfir, readiness | hits: 0
No direct evidence hits for this query.
DFIR-051 - Eradication readiness control 09
gap | severity 4 | evidence_count 0
Ensure Eradication procedures are documented, exercised, and reproducible for incident response readiness.
Expected evidence: Policy/procedure artifact showing ownership and cadence for Eradication.; Operational records (logs, tickets, reports, or runbooks) demonstrating Eradication execution.; Review evidence with remediation tracking for Eradication exceptions.
DFIR-Q-024 - containment verification checks evidence owner review log ticket runbook timeline
tags: containment, isolation, segmentation, response, incident_response, dfir, readiness | hits: 0
No direct evidence hits for this query.
DFIR-Q-026 - credential reset evidence evidence owner review log ticket runbook timeline
tags: eradication, remediation, patching, hardening, incident_response, dfir, readiness, evidence, forensics | hits: 0
No direct evidence hits for this query.
DFIR-Q-027 - patch deployment logs evidence owner review log ticket runbook timeline
tags: eradication, remediation, patching, hardening, incident_response, dfir, readiness | hits: 0
No direct evidence hits for this query.
DFIR-Q-028 - hardening checklist outputs evidence owner review log ticket runbook timeline
tags: eradication, remediation, patching, hardening, incident_response, dfir, readiness | hits: 0
No direct evidence hits for this query.
DFIR-Q-029 - vulnerability closure notes evidence owner review log ticket runbook timeline
tags: eradication, remediation, patching, hardening, incident_response, dfir, readiness | hits: 0
No direct evidence hits for this query.
DFIR-052 - Eradication readiness control 10
gap | severity 5 | evidence_count 0
Ensure Eradication procedures are documented, exercised, and reproducible for incident response readiness.
Expected evidence: Policy/procedure artifact showing ownership and cadence for Eradication.; Operational records (logs, tickets, reports, or runbooks) demonstrating Eradication execution.; Review evidence with remediation tracking for Eradication exceptions.
DFIR-Q-027 - patch deployment logs evidence owner review log ticket runbook timeline
tags: eradication, remediation, patching, hardening, incident_response, dfir, readiness | hits: 0
No direct evidence hits for this query.
DFIR-Q-028 - hardening checklist outputs evidence owner review log ticket runbook timeline
tags: eradication, remediation, patching, hardening, incident_response, dfir, readiness | hits: 0
No direct evidence hits for this query.
DFIR-Q-029 - vulnerability closure notes evidence owner review log ticket runbook timeline
tags: eradication, remediation, patching, hardening, incident_response, dfir, readiness | hits: 0
No direct evidence hits for this query.
DFIR-053 - Eradication readiness control 11
gap | severity 1 | evidence_count 0
Ensure Eradication procedures are documented, exercised, and reproducible for incident response readiness.
Expected evidence: Policy/procedure artifact showing ownership and cadence for Eradication.; Operational records (logs, tickets, reports, or runbooks) demonstrating Eradication execution.; Review evidence with remediation tracking for Eradication exceptions.
DFIR-Q-027 - patch deployment logs evidence owner review log ticket runbook timeline
tags: eradication, remediation, patching, hardening, incident_response, dfir, readiness | hits: 0
No direct evidence hits for this query.
DFIR-Q-028 - hardening checklist outputs evidence owner review log ticket runbook timeline
tags: eradication, remediation, patching, hardening, incident_response, dfir, readiness | hits: 0
No direct evidence hits for this query.
DFIR-Q-029 - vulnerability closure notes evidence owner review log ticket runbook timeline
tags: eradication, remediation, patching, hardening, incident_response, dfir, readiness | hits: 0
No direct evidence hits for this query.
DFIR-Q-030 - persistence hunting artifacts evidence owner review log ticket runbook timeline
tags: eradication, remediation, patching, hardening, incident_response, dfir, readiness | hits: 0
No direct evidence hits for this query.
DFIR-054 - Eradication readiness control 12
gap | severity 2 | evidence_count 0
Ensure Eradication procedures are documented, exercised, and reproducible for incident response readiness.
Expected evidence: Policy/procedure artifact showing ownership and cadence for Eradication.; Operational records (logs, tickets, reports, or runbooks) demonstrating Eradication execution.; Review evidence with remediation tracking for Eradication exceptions.
DFIR-Q-028 - hardening checklist outputs evidence owner review log ticket runbook timeline
tags: eradication, remediation, patching, hardening, incident_response, dfir, readiness | hits: 0
No direct evidence hits for this query.
DFIR-Q-029 - vulnerability closure notes evidence owner review log ticket runbook timeline
tags: eradication, remediation, patching, hardening, incident_response, dfir, readiness | hits: 0
No direct evidence hits for this query.
DFIR-Q-030 - persistence hunting artifacts evidence owner review log ticket runbook timeline
tags: eradication, remediation, patching, hardening, incident_response, dfir, readiness | hits: 0
No direct evidence hits for this query.
DFIR-055 - Eradication readiness control 13
gap | severity 3 | evidence_count 0
Ensure Eradication procedures are documented, exercised, and reproducible for incident response readiness.
Expected evidence: Policy/procedure artifact showing ownership and cadence for Eradication.; Operational records (logs, tickets, reports, or runbooks) demonstrating Eradication execution.; Review evidence with remediation tracking for Eradication exceptions.
DFIR-Q-028 - hardening checklist outputs evidence owner review log ticket runbook timeline
tags: eradication, remediation, patching, hardening, incident_response, dfir, readiness | hits: 0
No direct evidence hits for this query.
DFIR-Q-029 - vulnerability closure notes evidence owner review log ticket runbook timeline
tags: eradication, remediation, patching, hardening, incident_response, dfir, readiness | hits: 0
No direct evidence hits for this query.
DFIR-Q-030 - persistence hunting artifacts evidence owner review log ticket runbook timeline
tags: eradication, remediation, patching, hardening, incident_response, dfir, readiness | hits: 0
No direct evidence hits for this query.
DFIR-Q-031 - root cause remediation tickets evidence owner review log ticket runbook timeline
tags: eradication, remediation, patching, hardening, incident_response, dfir, readiness | hits: 0
No direct evidence hits for this query.
DFIR-056 - Eradication readiness control 14
gap | severity 4 | evidence_count 0
Ensure Eradication procedures are documented, exercised, and reproducible for incident response readiness.
Expected evidence: Policy/procedure artifact showing ownership and cadence for Eradication.; Operational records (logs, tickets, reports, or runbooks) demonstrating Eradication execution.; Review evidence with remediation tracking for Eradication exceptions.
DFIR-Q-029 - vulnerability closure notes evidence owner review log ticket runbook timeline
tags: eradication, remediation, patching, hardening, incident_response, dfir, readiness | hits: 0
No direct evidence hits for this query.
DFIR-Q-030 - persistence hunting artifacts evidence owner review log ticket runbook timeline
tags: eradication, remediation, patching, hardening, incident_response, dfir, readiness | hits: 0
No direct evidence hits for this query.
DFIR-Q-031 - root cause remediation tickets evidence owner review log ticket runbook timeline
tags: eradication, remediation, patching, hardening, incident_response, dfir, readiness | hits: 0
No direct evidence hits for this query.
DFIR-057 - Recovery readiness control 01
gap | severity 1 | evidence_count 0
Ensure Recovery procedures are documented, exercised, and reproducible for incident response readiness.
Expected evidence: Policy/procedure artifact showing ownership and cadence for Recovery.; Operational records (logs, tickets, reports, or runbooks) demonstrating Recovery execution.; Review evidence with remediation tracking for Recovery exceptions.
DFIR-Q-025 - malware removal evidence evidence owner review log ticket runbook timeline
tags: eradication, remediation, patching, hardening, incident_response, dfir, readiness, evidence, forensics | hits: 0
No direct evidence hits for this query.
DFIR-Q-033 - backup status evidence evidence owner review log ticket runbook timeline
tags: recovery, backup, restore, continuity, incident_response, dfir, readiness, evidence, forensics | hits: 0
No direct evidence hits for this query.
DFIR-Q-037 - recovery communications evidence owner review log ticket runbook timeline
tags: recovery, backup, restore, continuity, incident_response, dfir, readiness, communications | hits: 0
No direct evidence hits for this query.
DFIR-Q-038 - recovery validation metrics evidence owner review log ticket runbook timeline
tags: recovery, backup, restore, continuity, incident_response, dfir, readiness | hits: 0
No direct evidence hits for this query.
DFIR-Q-039 - post-recovery monitoring evidence owner review log ticket runbook timeline
tags: recovery, backup, restore, continuity, incident_response, dfir, readiness | hits: 0
No direct evidence hits for this query.
DFIR-Q-040 - customer impact closure notes evidence owner review log ticket runbook timeline
tags: recovery, backup, restore, continuity, incident_response, dfir, readiness, communications | hits: 0
No direct evidence hits for this query.
DFIR-058 - Recovery readiness control 02
gap | severity 2 | evidence_count 0
Ensure Recovery procedures are documented, exercised, and reproducible for incident response readiness.
Expected evidence: Policy/procedure artifact showing ownership and cadence for Recovery.; Operational records (logs, tickets, reports, or runbooks) demonstrating Recovery execution.; Review evidence with remediation tracking for Recovery exceptions.
DFIR-Q-025 - malware removal evidence evidence owner review log ticket runbook timeline
tags: eradication, remediation, patching, hardening, incident_response, dfir, readiness, evidence, forensics | hits: 0
No direct evidence hits for this query.
DFIR-Q-026 - credential reset evidence evidence owner review log ticket runbook timeline
tags: eradication, remediation, patching, hardening, incident_response, dfir, readiness, evidence, forensics | hits: 0
No direct evidence hits for this query.
DFIR-Q-033 - backup status evidence evidence owner review log ticket runbook timeline
tags: recovery, backup, restore, continuity, incident_response, dfir, readiness, evidence, forensics | hits: 0
No direct evidence hits for this query.
DFIR-Q-038 - recovery validation metrics evidence owner review log ticket runbook timeline
tags: recovery, backup, restore, continuity, incident_response, dfir, readiness | hits: 0
No direct evidence hits for this query.
DFIR-Q-039 - post-recovery monitoring evidence owner review log ticket runbook timeline
tags: recovery, backup, restore, continuity, incident_response, dfir, readiness | hits: 0
No direct evidence hits for this query.
DFIR-Q-040 - customer impact closure notes evidence owner review log ticket runbook timeline
tags: recovery, backup, restore, continuity, incident_response, dfir, readiness, communications | hits: 0
No direct evidence hits for this query.
DFIR-059 - Recovery readiness control 03
gap | severity 3 | evidence_count 0
Ensure Recovery procedures are documented, exercised, and reproducible for incident response readiness.
Expected evidence: Policy/procedure artifact showing ownership and cadence for Recovery.; Operational records (logs, tickets, reports, or runbooks) demonstrating Recovery execution.; Review evidence with remediation tracking for Recovery exceptions.
DFIR-Q-026 - credential reset evidence evidence owner review log ticket runbook timeline
tags: eradication, remediation, patching, hardening, incident_response, dfir, readiness, evidence, forensics | hits: 0
No direct evidence hits for this query.
DFIR-Q-027 - patch deployment logs evidence owner review log ticket runbook timeline
tags: eradication, remediation, patching, hardening, incident_response, dfir, readiness | hits: 0
No direct evidence hits for this query.
DFIR-Q-033 - backup status evidence evidence owner review log ticket runbook timeline
tags: recovery, backup, restore, continuity, incident_response, dfir, readiness, evidence, forensics | hits: 0
No direct evidence hits for this query.
DFIR-Q-034 - restore test reports evidence owner review log ticket runbook timeline
tags: recovery, backup, restore, continuity, incident_response, dfir, readiness | hits: 0
No direct evidence hits for this query.
DFIR-Q-038 - recovery validation metrics evidence owner review log ticket runbook timeline
tags: recovery, backup, restore, continuity, incident_response, dfir, readiness | hits: 0
No direct evidence hits for this query.
DFIR-Q-039 - post-recovery monitoring evidence owner review log ticket runbook timeline
tags: recovery, backup, restore, continuity, incident_response, dfir, readiness | hits: 0
No direct evidence hits for this query.
DFIR-Q-040 - customer impact closure notes evidence owner review log ticket runbook timeline
tags: recovery, backup, restore, continuity, incident_response, dfir, readiness, communications | hits: 0
No direct evidence hits for this query.
DFIR-060 - Recovery readiness control 04
gap | severity 4 | evidence_count 0
Ensure Recovery procedures are documented, exercised, and reproducible for incident response readiness.
Expected evidence: Policy/procedure artifact showing ownership and cadence for Recovery.; Operational records (logs, tickets, reports, or runbooks) demonstrating Recovery execution.; Review evidence with remediation tracking for Recovery exceptions.
DFIR-Q-027 - patch deployment logs evidence owner review log ticket runbook timeline
tags: eradication, remediation, patching, hardening, incident_response, dfir, readiness | hits: 0
No direct evidence hits for this query.
DFIR-Q-028 - hardening checklist outputs evidence owner review log ticket runbook timeline
tags: eradication, remediation, patching, hardening, incident_response, dfir, readiness | hits: 0
No direct evidence hits for this query.
DFIR-Q-033 - backup status evidence evidence owner review log ticket runbook timeline
tags: recovery, backup, restore, continuity, incident_response, dfir, readiness, evidence, forensics | hits: 0
No direct evidence hits for this query.
DFIR-Q-034 - restore test reports evidence owner review log ticket runbook timeline
tags: recovery, backup, restore, continuity, incident_response, dfir, readiness | hits: 0
No direct evidence hits for this query.
DFIR-Q-039 - post-recovery monitoring evidence owner review log ticket runbook timeline
tags: recovery, backup, restore, continuity, incident_response, dfir, readiness | hits: 0
No direct evidence hits for this query.
DFIR-Q-040 - customer impact closure notes evidence owner review log ticket runbook timeline
tags: recovery, backup, restore, continuity, incident_response, dfir, readiness, communications | hits: 0
No direct evidence hits for this query.
DFIR-061 - Recovery readiness control 05
gap | severity 5 | evidence_count 0
Ensure Recovery procedures are documented, exercised, and reproducible for incident response readiness.
Expected evidence: Policy/procedure artifact showing ownership and cadence for Recovery.; Operational records (logs, tickets, reports, or runbooks) demonstrating Recovery execution.; Review evidence with remediation tracking for Recovery exceptions.
DFIR-Q-028 - hardening checklist outputs evidence owner review log ticket runbook timeline
tags: eradication, remediation, patching, hardening, incident_response, dfir, readiness | hits: 0
No direct evidence hits for this query.
DFIR-Q-029 - vulnerability closure notes evidence owner review log ticket runbook timeline
tags: eradication, remediation, patching, hardening, incident_response, dfir, readiness | hits: 0
No direct evidence hits for this query.
DFIR-Q-033 - backup status evidence evidence owner review log ticket runbook timeline
tags: recovery, backup, restore, continuity, incident_response, dfir, readiness, evidence, forensics | hits: 0
No direct evidence hits for this query.
DFIR-Q-034 - restore test reports evidence owner review log ticket runbook timeline
tags: recovery, backup, restore, continuity, incident_response, dfir, readiness | hits: 0
No direct evidence hits for this query.
DFIR-Q-035 - service restoration runbooks evidence owner review log ticket runbook timeline
tags: recovery, backup, restore, continuity, incident_response, dfir, readiness | hits: 0
No direct evidence hits for this query.
DFIR-Q-039 - post-recovery monitoring evidence owner review log ticket runbook timeline
tags: recovery, backup, restore, continuity, incident_response, dfir, readiness | hits: 0
No direct evidence hits for this query.
DFIR-Q-040 - customer impact closure notes evidence owner review log ticket runbook timeline
tags: recovery, backup, restore, continuity, incident_response, dfir, readiness, communications | hits: 0
No direct evidence hits for this query.
DFIR-062 - Recovery readiness control 06
gap | severity 1 | evidence_count 0
Ensure Recovery procedures are documented, exercised, and reproducible for incident response readiness.
Expected evidence: Policy/procedure artifact showing ownership and cadence for Recovery.; Operational records (logs, tickets, reports, or runbooks) demonstrating Recovery execution.; Review evidence with remediation tracking for Recovery exceptions.
DFIR-Q-029 - vulnerability closure notes evidence owner review log ticket runbook timeline
tags: eradication, remediation, patching, hardening, incident_response, dfir, readiness | hits: 0
No direct evidence hits for this query.
DFIR-Q-030 - persistence hunting artifacts evidence owner review log ticket runbook timeline
tags: eradication, remediation, patching, hardening, incident_response, dfir, readiness | hits: 0
No direct evidence hits for this query.
DFIR-Q-033 - backup status evidence evidence owner review log ticket runbook timeline
tags: recovery, backup, restore, continuity, incident_response, dfir, readiness, evidence, forensics | hits: 0
No direct evidence hits for this query.
DFIR-Q-034 - restore test reports evidence owner review log ticket runbook timeline
tags: recovery, backup, restore, continuity, incident_response, dfir, readiness | hits: 0
No direct evidence hits for this query.
DFIR-Q-035 - service restoration runbooks evidence owner review log ticket runbook timeline
tags: recovery, backup, restore, continuity, incident_response, dfir, readiness | hits: 0
No direct evidence hits for this query.
DFIR-Q-040 - customer impact closure notes evidence owner review log ticket runbook timeline
tags: recovery, backup, restore, continuity, incident_response, dfir, readiness, communications | hits: 0
No direct evidence hits for this query.
DFIR-063 - Recovery readiness control 07
gap | severity 2 | evidence_count 0
Ensure Recovery procedures are documented, exercised, and reproducible for incident response readiness.
Expected evidence: Policy/procedure artifact showing ownership and cadence for Recovery.; Operational records (logs, tickets, reports, or runbooks) demonstrating Recovery execution.; Review evidence with remediation tracking for Recovery exceptions.
DFIR-Q-030 - persistence hunting artifacts evidence owner review log ticket runbook timeline
tags: eradication, remediation, patching, hardening, incident_response, dfir, readiness | hits: 0
No direct evidence hits for this query.
DFIR-Q-031 - root cause remediation tickets evidence owner review log ticket runbook timeline
tags: eradication, remediation, patching, hardening, incident_response, dfir, readiness | hits: 0
No direct evidence hits for this query.
DFIR-Q-033 - backup status evidence evidence owner review log ticket runbook timeline
tags: recovery, backup, restore, continuity, incident_response, dfir, readiness, evidence, forensics | hits: 0
No direct evidence hits for this query.
DFIR-Q-034 - restore test reports evidence owner review log ticket runbook timeline
tags: recovery, backup, restore, continuity, incident_response, dfir, readiness | hits: 0
No direct evidence hits for this query.
DFIR-Q-035 - service restoration runbooks evidence owner review log ticket runbook timeline
tags: recovery, backup, restore, continuity, incident_response, dfir, readiness | hits: 0
No direct evidence hits for this query.
DFIR-Q-036 - business continuity checkpoints evidence owner review log ticket runbook timeline
tags: recovery, backup, restore, continuity, incident_response, dfir, readiness | hits: 0
No direct evidence hits for this query.
DFIR-Q-040 - customer impact closure notes evidence owner review log ticket runbook timeline
tags: recovery, backup, restore, continuity, incident_response, dfir, readiness, communications | hits: 0
No direct evidence hits for this query.
DFIR-064 - Recovery readiness control 08
gap | severity 3 | evidence_count 0
Ensure Recovery procedures are documented, exercised, and reproducible for incident response readiness.
Expected evidence: Policy/procedure artifact showing ownership and cadence for Recovery.; Operational records (logs, tickets, reports, or runbooks) demonstrating Recovery execution.; Review evidence with remediation tracking for Recovery exceptions.
DFIR-Q-031 - root cause remediation tickets evidence owner review log ticket runbook timeline
tags: eradication, remediation, patching, hardening, incident_response, dfir, readiness | hits: 0
No direct evidence hits for this query.
DFIR-Q-032 - change management records evidence owner review log ticket runbook timeline
tags: eradication, remediation, patching, hardening, incident_response, dfir, readiness, change_management | hits: 0
No direct evidence hits for this query.
DFIR-Q-034 - restore test reports evidence owner review log ticket runbook timeline
tags: recovery, backup, restore, continuity, incident_response, dfir, readiness | hits: 0
No direct evidence hits for this query.
DFIR-Q-035 - service restoration runbooks evidence owner review log ticket runbook timeline
tags: recovery, backup, restore, continuity, incident_response, dfir, readiness | hits: 0
No direct evidence hits for this query.
DFIR-Q-036 - business continuity checkpoints evidence owner review log ticket runbook timeline
tags: recovery, backup, restore, continuity, incident_response, dfir, readiness | hits: 0
No direct evidence hits for this query.
DFIR-065 - Recovery readiness control 09
gap | severity 4 | evidence_count 0
Ensure Recovery procedures are documented, exercised, and reproducible for incident response readiness.
Expected evidence: Policy/procedure artifact showing ownership and cadence for Recovery.; Operational records (logs, tickets, reports, or runbooks) demonstrating Recovery execution.; Review evidence with remediation tracking for Recovery exceptions.
DFIR-Q-032 - change management records evidence owner review log ticket runbook timeline
tags: eradication, remediation, patching, hardening, incident_response, dfir, readiness, change_management | hits: 0
No direct evidence hits for this query.
DFIR-Q-034 - restore test reports evidence owner review log ticket runbook timeline
tags: recovery, backup, restore, continuity, incident_response, dfir, readiness | hits: 0
No direct evidence hits for this query.
DFIR-Q-035 - service restoration runbooks evidence owner review log ticket runbook timeline
tags: recovery, backup, restore, continuity, incident_response, dfir, readiness | hits: 0
No direct evidence hits for this query.
DFIR-Q-036 - business continuity checkpoints evidence owner review log ticket runbook timeline
tags: recovery, backup, restore, continuity, incident_response, dfir, readiness | hits: 0
No direct evidence hits for this query.
DFIR-Q-037 - recovery communications evidence owner review log ticket runbook timeline
tags: recovery, backup, restore, continuity, incident_response, dfir, readiness, communications | hits: 0
No direct evidence hits for this query.
DFIR-066 - Recovery readiness control 10
gap | severity 5 | evidence_count 0
Ensure Recovery procedures are documented, exercised, and reproducible for incident response readiness.
Expected evidence: Policy/procedure artifact showing ownership and cadence for Recovery.; Operational records (logs, tickets, reports, or runbooks) demonstrating Recovery execution.; Review evidence with remediation tracking for Recovery exceptions.
DFIR-Q-035 - service restoration runbooks evidence owner review log ticket runbook timeline
tags: recovery, backup, restore, continuity, incident_response, dfir, readiness | hits: 0
No direct evidence hits for this query.
DFIR-Q-036 - business continuity checkpoints evidence owner review log ticket runbook timeline
tags: recovery, backup, restore, continuity, incident_response, dfir, readiness | hits: 0
No direct evidence hits for this query.
DFIR-Q-037 - recovery communications evidence owner review log ticket runbook timeline
tags: recovery, backup, restore, continuity, incident_response, dfir, readiness, communications | hits: 0
No direct evidence hits for this query.
DFIR-067 - Recovery readiness control 11
gap | severity 1 | evidence_count 0
Ensure Recovery procedures are documented, exercised, and reproducible for incident response readiness.
Expected evidence: Policy/procedure artifact showing ownership and cadence for Recovery.; Operational records (logs, tickets, reports, or runbooks) demonstrating Recovery execution.; Review evidence with remediation tracking for Recovery exceptions.
DFIR-Q-035 - service restoration runbooks evidence owner review log ticket runbook timeline
tags: recovery, backup, restore, continuity, incident_response, dfir, readiness | hits: 0
No direct evidence hits for this query.
DFIR-Q-036 - business continuity checkpoints evidence owner review log ticket runbook timeline
tags: recovery, backup, restore, continuity, incident_response, dfir, readiness | hits: 0
No direct evidence hits for this query.
DFIR-Q-037 - recovery communications evidence owner review log ticket runbook timeline
tags: recovery, backup, restore, continuity, incident_response, dfir, readiness, communications | hits: 0
No direct evidence hits for this query.
DFIR-Q-038 - recovery validation metrics evidence owner review log ticket runbook timeline
tags: recovery, backup, restore, continuity, incident_response, dfir, readiness | hits: 0
No direct evidence hits for this query.
DFIR-068 - Recovery readiness control 12
gap | severity 2 | evidence_count 0
Ensure Recovery procedures are documented, exercised, and reproducible for incident response readiness.
Expected evidence: Policy/procedure artifact showing ownership and cadence for Recovery.; Operational records (logs, tickets, reports, or runbooks) demonstrating Recovery execution.; Review evidence with remediation tracking for Recovery exceptions.
DFIR-Q-036 - business continuity checkpoints evidence owner review log ticket runbook timeline
tags: recovery, backup, restore, continuity, incident_response, dfir, readiness | hits: 0
No direct evidence hits for this query.
DFIR-Q-037 - recovery communications evidence owner review log ticket runbook timeline
tags: recovery, backup, restore, continuity, incident_response, dfir, readiness, communications | hits: 0
No direct evidence hits for this query.
DFIR-Q-038 - recovery validation metrics evidence owner review log ticket runbook timeline
tags: recovery, backup, restore, continuity, incident_response, dfir, readiness | hits: 0
No direct evidence hits for this query.
DFIR-069 - Recovery readiness control 13
gap | severity 3 | evidence_count 0
Ensure Recovery procedures are documented, exercised, and reproducible for incident response readiness.
Expected evidence: Policy/procedure artifact showing ownership and cadence for Recovery.; Operational records (logs, tickets, reports, or runbooks) demonstrating Recovery execution.; Review evidence with remediation tracking for Recovery exceptions.
DFIR-Q-036 - business continuity checkpoints evidence owner review log ticket runbook timeline
tags: recovery, backup, restore, continuity, incident_response, dfir, readiness | hits: 0
No direct evidence hits for this query.
DFIR-Q-037 - recovery communications evidence owner review log ticket runbook timeline
tags: recovery, backup, restore, continuity, incident_response, dfir, readiness, communications | hits: 0
No direct evidence hits for this query.
DFIR-Q-038 - recovery validation metrics evidence owner review log ticket runbook timeline
tags: recovery, backup, restore, continuity, incident_response, dfir, readiness | hits: 0
No direct evidence hits for this query.
DFIR-Q-039 - post-recovery monitoring evidence owner review log ticket runbook timeline
tags: recovery, backup, restore, continuity, incident_response, dfir, readiness | hits: 0
No direct evidence hits for this query.
DFIR-070 - Recovery readiness control 14
gap | severity 4 | evidence_count 0
Ensure Recovery procedures are documented, exercised, and reproducible for incident response readiness.
Expected evidence: Policy/procedure artifact showing ownership and cadence for Recovery.; Operational records (logs, tickets, reports, or runbooks) demonstrating Recovery execution.; Review evidence with remediation tracking for Recovery exceptions.
DFIR-Q-037 - recovery communications evidence owner review log ticket runbook timeline
tags: recovery, backup, restore, continuity, incident_response, dfir, readiness, communications | hits: 0
No direct evidence hits for this query.
DFIR-Q-038 - recovery validation metrics evidence owner review log ticket runbook timeline
tags: recovery, backup, restore, continuity, incident_response, dfir, readiness | hits: 0
No direct evidence hits for this query.
DFIR-Q-039 - post-recovery monitoring evidence owner review log ticket runbook timeline
tags: recovery, backup, restore, continuity, incident_response, dfir, readiness | hits: 0
No direct evidence hits for this query.
DFIR-071 - PostIncident readiness control 01
gap | severity 1 | evidence_count 0
Ensure PostIncident procedures are documented, exercised, and reproducible for incident response readiness.
Expected evidence: Policy/procedure artifact showing ownership and cadence for PostIncident.; Operational records (logs, tickets, reports, or runbooks) demonstrating PostIncident execution.; Review evidence with remediation tracking for PostIncident exceptions.
DFIR-Q-033 - backup status evidence evidence owner review log ticket runbook timeline
tags: recovery, backup, restore, continuity, incident_response, dfir, readiness, evidence, forensics | hits: 0
No direct evidence hits for this query.
DFIR-Q-041 - post-incident review minutes evidence owner review log ticket runbook timeline
tags: postincident, lessons_learned, improvement, governance, incident_response, dfir, readiness | hits: 0
No direct evidence hits for this query.
DFIR-Q-045 - control improvement backlog evidence owner review log ticket runbook timeline
tags: postincident, lessons_learned, improvement, governance, incident_response, dfir, readiness | hits: 0
No direct evidence hits for this query.
DFIR-Q-046 - executive briefing records evidence owner review log ticket runbook timeline
tags: postincident, lessons_learned, improvement, governance, incident_response, dfir, readiness | hits: 0
No direct evidence hits for this query.
DFIR-Q-047 - regulator/customer comms log evidence owner review log ticket runbook timeline
tags: postincident, lessons_learned, improvement, governance, incident_response, dfir, readiness, communications | hits: 0
No direct evidence hits for this query.
DFIR-Q-048 - evidence retention decisions evidence owner review log ticket runbook timeline
tags: postincident, lessons_learned, improvement, governance, incident_response, dfir, readiness, evidence, forensics | hits: 0
No direct evidence hits for this query.
DFIR-072 - PostIncident readiness control 02
gap | severity 2 | evidence_count 0
Ensure PostIncident procedures are documented, exercised, and reproducible for incident response readiness.
Expected evidence: Policy/procedure artifact showing ownership and cadence for PostIncident.; Operational records (logs, tickets, reports, or runbooks) demonstrating PostIncident execution.; Review evidence with remediation tracking for PostIncident exceptions.
DFIR-Q-033 - backup status evidence evidence owner review log ticket runbook timeline
tags: recovery, backup, restore, continuity, incident_response, dfir, readiness, evidence, forensics | hits: 0
No direct evidence hits for this query.
DFIR-Q-034 - restore test reports evidence owner review log ticket runbook timeline
tags: recovery, backup, restore, continuity, incident_response, dfir, readiness | hits: 0
No direct evidence hits for this query.
DFIR-Q-041 - post-incident review minutes evidence owner review log ticket runbook timeline
tags: postincident, lessons_learned, improvement, governance, incident_response, dfir, readiness | hits: 0
No direct evidence hits for this query.
DFIR-Q-046 - executive briefing records evidence owner review log ticket runbook timeline
tags: postincident, lessons_learned, improvement, governance, incident_response, dfir, readiness | hits: 0
No direct evidence hits for this query.
DFIR-Q-047 - regulator/customer comms log evidence owner review log ticket runbook timeline
tags: postincident, lessons_learned, improvement, governance, incident_response, dfir, readiness, communications | hits: 0
No direct evidence hits for this query.
DFIR-Q-048 - evidence retention decisions evidence owner review log ticket runbook timeline
tags: postincident, lessons_learned, improvement, governance, incident_response, dfir, readiness, evidence, forensics | hits: 0
No direct evidence hits for this query.
DFIR-073 - PostIncident readiness control 03
gap | severity 3 | evidence_count 0
Ensure PostIncident procedures are documented, exercised, and reproducible for incident response readiness.
Expected evidence: Policy/procedure artifact showing ownership and cadence for PostIncident.; Operational records (logs, tickets, reports, or runbooks) demonstrating PostIncident execution.; Review evidence with remediation tracking for PostIncident exceptions.
DFIR-Q-034 - restore test reports evidence owner review log ticket runbook timeline
tags: recovery, backup, restore, continuity, incident_response, dfir, readiness | hits: 0
No direct evidence hits for this query.
DFIR-Q-035 - service restoration runbooks evidence owner review log ticket runbook timeline
tags: recovery, backup, restore, continuity, incident_response, dfir, readiness | hits: 0
No direct evidence hits for this query.
DFIR-Q-041 - post-incident review minutes evidence owner review log ticket runbook timeline
tags: postincident, lessons_learned, improvement, governance, incident_response, dfir, readiness | hits: 0
No direct evidence hits for this query.
DFIR-Q-042 - lessons learned register evidence owner review log ticket runbook timeline
tags: postincident, lessons_learned, improvement, governance, incident_response, dfir, readiness | hits: 0
No direct evidence hits for this query.
DFIR-Q-046 - executive briefing records evidence owner review log ticket runbook timeline
tags: postincident, lessons_learned, improvement, governance, incident_response, dfir, readiness | hits: 0
No direct evidence hits for this query.
DFIR-Q-047 - regulator/customer comms log evidence owner review log ticket runbook timeline
tags: postincident, lessons_learned, improvement, governance, incident_response, dfir, readiness, communications | hits: 0
No direct evidence hits for this query.
DFIR-Q-048 - evidence retention decisions evidence owner review log ticket runbook timeline
tags: postincident, lessons_learned, improvement, governance, incident_response, dfir, readiness, evidence, forensics | hits: 0
No direct evidence hits for this query.
DFIR-074 - PostIncident readiness control 04
gap | severity 4 | evidence_count 0
Ensure PostIncident procedures are documented, exercised, and reproducible for incident response readiness.
Expected evidence: Policy/procedure artifact showing ownership and cadence for PostIncident.; Operational records (logs, tickets, reports, or runbooks) demonstrating PostIncident execution.; Review evidence with remediation tracking for PostIncident exceptions.
DFIR-Q-035 - service restoration runbooks evidence owner review log ticket runbook timeline
tags: recovery, backup, restore, continuity, incident_response, dfir, readiness | hits: 0
No direct evidence hits for this query.
DFIR-Q-036 - business continuity checkpoints evidence owner review log ticket runbook timeline
tags: recovery, backup, restore, continuity, incident_response, dfir, readiness | hits: 0
No direct evidence hits for this query.
DFIR-Q-041 - post-incident review minutes evidence owner review log ticket runbook timeline
tags: postincident, lessons_learned, improvement, governance, incident_response, dfir, readiness | hits: 0
No direct evidence hits for this query.
DFIR-Q-042 - lessons learned register evidence owner review log ticket runbook timeline
tags: postincident, lessons_learned, improvement, governance, incident_response, dfir, readiness | hits: 0
No direct evidence hits for this query.
DFIR-Q-047 - regulator/customer comms log evidence owner review log ticket runbook timeline
tags: postincident, lessons_learned, improvement, governance, incident_response, dfir, readiness, communications | hits: 0
No direct evidence hits for this query.
DFIR-Q-048 - evidence retention decisions evidence owner review log ticket runbook timeline
tags: postincident, lessons_learned, improvement, governance, incident_response, dfir, readiness, evidence, forensics | hits: 0
No direct evidence hits for this query.
DFIR-075 - PostIncident readiness control 05
gap | severity 5 | evidence_count 0
Ensure PostIncident procedures are documented, exercised, and reproducible for incident response readiness.
Expected evidence: Policy/procedure artifact showing ownership and cadence for PostIncident.; Operational records (logs, tickets, reports, or runbooks) demonstrating PostIncident execution.; Review evidence with remediation tracking for PostIncident exceptions.
DFIR-Q-036 - business continuity checkpoints evidence owner review log ticket runbook timeline
tags: recovery, backup, restore, continuity, incident_response, dfir, readiness | hits: 0
No direct evidence hits for this query.
DFIR-Q-037 - recovery communications evidence owner review log ticket runbook timeline
tags: recovery, backup, restore, continuity, incident_response, dfir, readiness, communications | hits: 0
No direct evidence hits for this query.
DFIR-Q-041 - post-incident review minutes evidence owner review log ticket runbook timeline
tags: postincident, lessons_learned, improvement, governance, incident_response, dfir, readiness | hits: 0
No direct evidence hits for this query.
DFIR-Q-042 - lessons learned register evidence owner review log ticket runbook timeline
tags: postincident, lessons_learned, improvement, governance, incident_response, dfir, readiness | hits: 0
No direct evidence hits for this query.
DFIR-Q-043 - corrective action tracker evidence owner review log ticket runbook timeline
tags: postincident, lessons_learned, improvement, governance, incident_response, dfir, readiness | hits: 0
No direct evidence hits for this query.
DFIR-Q-047 - regulator/customer comms log evidence owner review log ticket runbook timeline
tags: postincident, lessons_learned, improvement, governance, incident_response, dfir, readiness, communications | hits: 0
No direct evidence hits for this query.
DFIR-Q-048 - evidence retention decisions evidence owner review log ticket runbook timeline
tags: postincident, lessons_learned, improvement, governance, incident_response, dfir, readiness, evidence, forensics | hits: 0
No direct evidence hits for this query.
DFIR-076 - PostIncident readiness control 06
gap | severity 1 | evidence_count 0
Ensure PostIncident procedures are documented, exercised, and reproducible for incident response readiness.
Expected evidence: Policy/procedure artifact showing ownership and cadence for PostIncident.; Operational records (logs, tickets, reports, or runbooks) demonstrating PostIncident execution.; Review evidence with remediation tracking for PostIncident exceptions.
DFIR-Q-037 - recovery communications evidence owner review log ticket runbook timeline
tags: recovery, backup, restore, continuity, incident_response, dfir, readiness, communications | hits: 0
No direct evidence hits for this query.
DFIR-Q-038 - recovery validation metrics evidence owner review log ticket runbook timeline
tags: recovery, backup, restore, continuity, incident_response, dfir, readiness | hits: 0
No direct evidence hits for this query.
DFIR-Q-041 - post-incident review minutes evidence owner review log ticket runbook timeline
tags: postincident, lessons_learned, improvement, governance, incident_response, dfir, readiness | hits: 0
No direct evidence hits for this query.
DFIR-Q-042 - lessons learned register evidence owner review log ticket runbook timeline
tags: postincident, lessons_learned, improvement, governance, incident_response, dfir, readiness | hits: 0
No direct evidence hits for this query.
DFIR-Q-043 - corrective action tracker evidence owner review log ticket runbook timeline
tags: postincident, lessons_learned, improvement, governance, incident_response, dfir, readiness | hits: 0
No direct evidence hits for this query.
DFIR-Q-048 - evidence retention decisions evidence owner review log ticket runbook timeline
tags: postincident, lessons_learned, improvement, governance, incident_response, dfir, readiness, evidence, forensics | hits: 0
No direct evidence hits for this query.
DFIR-077 - PostIncident readiness control 07
gap | severity 2 | evidence_count 0
Ensure PostIncident procedures are documented, exercised, and reproducible for incident response readiness.
Expected evidence: Policy/procedure artifact showing ownership and cadence for PostIncident.; Operational records (logs, tickets, reports, or runbooks) demonstrating PostIncident execution.; Review evidence with remediation tracking for PostIncident exceptions.
DFIR-Q-038 - recovery validation metrics evidence owner review log ticket runbook timeline
tags: recovery, backup, restore, continuity, incident_response, dfir, readiness | hits: 0
No direct evidence hits for this query.
DFIR-Q-039 - post-recovery monitoring evidence owner review log ticket runbook timeline
tags: recovery, backup, restore, continuity, incident_response, dfir, readiness | hits: 0
No direct evidence hits for this query.
DFIR-Q-041 - post-incident review minutes evidence owner review log ticket runbook timeline
tags: postincident, lessons_learned, improvement, governance, incident_response, dfir, readiness | hits: 0
No direct evidence hits for this query.
DFIR-Q-042 - lessons learned register evidence owner review log ticket runbook timeline
tags: postincident, lessons_learned, improvement, governance, incident_response, dfir, readiness | hits: 0
No direct evidence hits for this query.
DFIR-Q-043 - corrective action tracker evidence owner review log ticket runbook timeline
tags: postincident, lessons_learned, improvement, governance, incident_response, dfir, readiness | hits: 0
No direct evidence hits for this query.
DFIR-Q-044 - policy update changelog evidence owner review log ticket runbook timeline
tags: postincident, lessons_learned, improvement, governance, incident_response, dfir, readiness, change_management | hits: 0
No direct evidence hits for this query.
DFIR-Q-048 - evidence retention decisions evidence owner review log ticket runbook timeline
tags: postincident, lessons_learned, improvement, governance, incident_response, dfir, readiness, evidence, forensics | hits: 0
No direct evidence hits for this query.
DFIR-078 - PostIncident readiness control 08
gap | severity 3 | evidence_count 0
Ensure PostIncident procedures are documented, exercised, and reproducible for incident response readiness.
Expected evidence: Policy/procedure artifact showing ownership and cadence for PostIncident.; Operational records (logs, tickets, reports, or runbooks) demonstrating PostIncident execution.; Review evidence with remediation tracking for PostIncident exceptions.
DFIR-Q-039 - post-recovery monitoring evidence owner review log ticket runbook timeline
tags: recovery, backup, restore, continuity, incident_response, dfir, readiness | hits: 0
No direct evidence hits for this query.
DFIR-Q-040 - customer impact closure notes evidence owner review log ticket runbook timeline
tags: recovery, backup, restore, continuity, incident_response, dfir, readiness, communications | hits: 0
No direct evidence hits for this query.
DFIR-Q-042 - lessons learned register evidence owner review log ticket runbook timeline
tags: postincident, lessons_learned, improvement, governance, incident_response, dfir, readiness | hits: 0
No direct evidence hits for this query.
DFIR-Q-043 - corrective action tracker evidence owner review log ticket runbook timeline
tags: postincident, lessons_learned, improvement, governance, incident_response, dfir, readiness | hits: 0
No direct evidence hits for this query.
DFIR-Q-044 - policy update changelog evidence owner review log ticket runbook timeline
tags: postincident, lessons_learned, improvement, governance, incident_response, dfir, readiness, change_management | hits: 0
No direct evidence hits for this query.
DFIR-079 - PostIncident readiness control 09
gap | severity 4 | evidence_count 0
Ensure PostIncident procedures are documented, exercised, and reproducible for incident response readiness.
Expected evidence: Policy/procedure artifact showing ownership and cadence for PostIncident.; Operational records (logs, tickets, reports, or runbooks) demonstrating PostIncident execution.; Review evidence with remediation tracking for PostIncident exceptions.
DFIR-Q-040 - customer impact closure notes evidence owner review log ticket runbook timeline
tags: recovery, backup, restore, continuity, incident_response, dfir, readiness, communications | hits: 0
No direct evidence hits for this query.
DFIR-Q-042 - lessons learned register evidence owner review log ticket runbook timeline
tags: postincident, lessons_learned, improvement, governance, incident_response, dfir, readiness | hits: 0
No direct evidence hits for this query.
DFIR-Q-043 - corrective action tracker evidence owner review log ticket runbook timeline
tags: postincident, lessons_learned, improvement, governance, incident_response, dfir, readiness | hits: 0
No direct evidence hits for this query.
DFIR-Q-044 - policy update changelog evidence owner review log ticket runbook timeline
tags: postincident, lessons_learned, improvement, governance, incident_response, dfir, readiness, change_management | hits: 0
No direct evidence hits for this query.
DFIR-Q-045 - control improvement backlog evidence owner review log ticket runbook timeline
tags: postincident, lessons_learned, improvement, governance, incident_response, dfir, readiness | hits: 0
No direct evidence hits for this query.
DFIR-080 - PostIncident readiness control 10
gap | severity 5 | evidence_count 0
Ensure PostIncident procedures are documented, exercised, and reproducible for incident response readiness.
Expected evidence: Policy/procedure artifact showing ownership and cadence for PostIncident.; Operational records (logs, tickets, reports, or runbooks) demonstrating PostIncident execution.; Review evidence with remediation tracking for PostIncident exceptions.
DFIR-Q-043 - corrective action tracker evidence owner review log ticket runbook timeline
tags: postincident, lessons_learned, improvement, governance, incident_response, dfir, readiness | hits: 0
No direct evidence hits for this query.
DFIR-Q-044 - policy update changelog evidence owner review log ticket runbook timeline
tags: postincident, lessons_learned, improvement, governance, incident_response, dfir, readiness, change_management | hits: 0
No direct evidence hits for this query.
DFIR-Q-045 - control improvement backlog evidence owner review log ticket runbook timeline
tags: postincident, lessons_learned, improvement, governance, incident_response, dfir, readiness | hits: 0
No direct evidence hits for this query.
DFIR-081 - PostIncident readiness control 11
gap | severity 1 | evidence_count 0
Ensure PostIncident procedures are documented, exercised, and reproducible for incident response readiness.
Expected evidence: Policy/procedure artifact showing ownership and cadence for PostIncident.; Operational records (logs, tickets, reports, or runbooks) demonstrating PostIncident execution.; Review evidence with remediation tracking for PostIncident exceptions.
DFIR-Q-043 - corrective action tracker evidence owner review log ticket runbook timeline
tags: postincident, lessons_learned, improvement, governance, incident_response, dfir, readiness | hits: 0
No direct evidence hits for this query.
DFIR-Q-044 - policy update changelog evidence owner review log ticket runbook timeline
tags: postincident, lessons_learned, improvement, governance, incident_response, dfir, readiness, change_management | hits: 0
No direct evidence hits for this query.
DFIR-Q-045 - control improvement backlog evidence owner review log ticket runbook timeline
tags: postincident, lessons_learned, improvement, governance, incident_response, dfir, readiness | hits: 0
No direct evidence hits for this query.
DFIR-Q-046 - executive briefing records evidence owner review log ticket runbook timeline
tags: postincident, lessons_learned, improvement, governance, incident_response, dfir, readiness | hits: 0
No direct evidence hits for this query.
DFIR-082 - PostIncident readiness control 12
gap | severity 2 | evidence_count 0
Ensure PostIncident procedures are documented, exercised, and reproducible for incident response readiness.
Expected evidence: Policy/procedure artifact showing ownership and cadence for PostIncident.; Operational records (logs, tickets, reports, or runbooks) demonstrating PostIncident execution.; Review evidence with remediation tracking for PostIncident exceptions.
DFIR-Q-044 - policy update changelog evidence owner review log ticket runbook timeline
tags: postincident, lessons_learned, improvement, governance, incident_response, dfir, readiness, change_management | hits: 0
No direct evidence hits for this query.
DFIR-Q-045 - control improvement backlog evidence owner review log ticket runbook timeline
tags: postincident, lessons_learned, improvement, governance, incident_response, dfir, readiness | hits: 0
No direct evidence hits for this query.
DFIR-Q-046 - executive briefing records evidence owner review log ticket runbook timeline
tags: postincident, lessons_learned, improvement, governance, incident_response, dfir, readiness | hits: 0
No direct evidence hits for this query.
DFIR-083 - PostIncident readiness control 13
gap | severity 3 | evidence_count 0
Ensure PostIncident procedures are documented, exercised, and reproducible for incident response readiness.
Expected evidence: Policy/procedure artifact showing ownership and cadence for PostIncident.; Operational records (logs, tickets, reports, or runbooks) demonstrating PostIncident execution.; Review evidence with remediation tracking for PostIncident exceptions.
DFIR-Q-044 - policy update changelog evidence owner review log ticket runbook timeline
tags: postincident, lessons_learned, improvement, governance, incident_response, dfir, readiness, change_management | hits: 0
No direct evidence hits for this query.
DFIR-Q-045 - control improvement backlog evidence owner review log ticket runbook timeline
tags: postincident, lessons_learned, improvement, governance, incident_response, dfir, readiness | hits: 0
No direct evidence hits for this query.
DFIR-Q-046 - executive briefing records evidence owner review log ticket runbook timeline
tags: postincident, lessons_learned, improvement, governance, incident_response, dfir, readiness | hits: 0
No direct evidence hits for this query.
DFIR-Q-047 - regulator/customer comms log evidence owner review log ticket runbook timeline
tags: postincident, lessons_learned, improvement, governance, incident_response, dfir, readiness, communications | hits: 0
No direct evidence hits for this query.
DFIR-084 - PostIncident readiness control 14
gap | severity 4 | evidence_count 0
Ensure PostIncident procedures are documented, exercised, and reproducible for incident response readiness.
Expected evidence: Policy/procedure artifact showing ownership and cadence for PostIncident.; Operational records (logs, tickets, reports, or runbooks) demonstrating PostIncident execution.; Review evidence with remediation tracking for PostIncident exceptions.
DFIR-Q-045 - control improvement backlog evidence owner review log ticket runbook timeline
tags: postincident, lessons_learned, improvement, governance, incident_response, dfir, readiness | hits: 0
No direct evidence hits for this query.
DFIR-Q-046 - executive briefing records evidence owner review log ticket runbook timeline
tags: postincident, lessons_learned, improvement, governance, incident_response, dfir, readiness | hits: 0
No direct evidence hits for this query.
DFIR-Q-047 - regulator/customer comms log evidence owner review log ticket runbook timeline
tags: postincident, lessons_learned, improvement, governance, incident_response, dfir, readiness, communications | hits: 0
No direct evidence hits for this query.
Query Log
| query_id | query_text | tags | hits |
|---|---|---|---|
DFIR-Q-001 | incident response plan evidence owner review log ticket runbook timeline | preparation, planning, governance, readiness, incident_response, dfir | 0 |
DFIR-Q-002 | communications playbook evidence owner review log ticket runbook timeline | preparation, planning, governance, readiness, incident_response, dfir, communications | 0 |
DFIR-Q-003 | stakeholder contact list evidence owner review log ticket runbook timeline | preparation, planning, governance, readiness, incident_response, dfir | 0 |
DFIR-Q-004 | evidence handling standards evidence owner review log ticket runbook timeline | preparation, planning, governance, readiness, incident_response, dfir, evidence, forensics | 0 |
DFIR-Q-005 | chain-of-custody template evidence owner review log ticket runbook timeline | preparation, planning, governance, readiness, incident_response, dfir, evidence, forensics | 0 |
DFIR-Q-006 | escalation matrix evidence owner review log ticket runbook timeline | preparation, planning, governance, readiness, incident_response, dfir | 0 |
DFIR-Q-007 | training exercise records evidence owner review log ticket runbook timeline | preparation, planning, governance, readiness, incident_response, dfir | 0 |
DFIR-Q-008 | tabletop outcomes evidence owner review log ticket runbook timeline | preparation, planning, governance, readiness, incident_response, dfir | 0 |
DFIR-Q-009 | edr telemetry evidence evidence owner review log ticket runbook timeline | detection, analysis, triage, telemetry, incident_response, dfir, readiness, logging, monitoring, evidence, forensics | 0 |
DFIR-Q-010 | siem alert triage logs evidence owner review log ticket runbook timeline | detection, analysis, triage, telemetry, incident_response, dfir, readiness, logging, monitoring | 0 |
DFIR-Q-011 | incident classification records evidence owner review log ticket runbook timeline | detection, analysis, triage, telemetry, incident_response, dfir, readiness | 0 |
DFIR-Q-012 | forensic timeline notes evidence owner review log ticket runbook timeline | detection, analysis, triage, telemetry, incident_response, dfir, readiness | 0 |
DFIR-Q-013 | ioc tracking artifacts evidence owner review log ticket runbook timeline | detection, analysis, triage, telemetry, incident_response, dfir, readiness | 0 |
DFIR-Q-014 | time sync ntp evidence evidence owner review log ticket runbook timeline | detection, analysis, triage, telemetry, incident_response, dfir, readiness, evidence, forensics, time_sync | 0 |
DFIR-Q-015 | logging retention policy evidence owner review log ticket runbook timeline | detection, analysis, triage, telemetry, incident_response, dfir, readiness, logging, monitoring | 0 |
DFIR-Q-016 | admin account monitoring records evidence owner review log ticket runbook timeline | detection, analysis, triage, telemetry, incident_response, dfir, readiness, privileged_access | 0 |
DFIR-Q-017 | host isolation records evidence owner review log ticket runbook timeline | containment, isolation, segmentation, response, incident_response, dfir, readiness | 0 |
DFIR-Q-018 | network segmentation indicators evidence owner review log ticket runbook timeline | containment, isolation, segmentation, response, incident_response, dfir, readiness | 0 |
DFIR-Q-019 | access revocation logs evidence owner review log ticket runbook timeline | containment, isolation, segmentation, response, incident_response, dfir, readiness | 0 |
DFIR-Q-020 | temporary firewall changes evidence owner review log ticket runbook timeline | containment, isolation, segmentation, response, incident_response, dfir, readiness, change_management | 0 |
DFIR-Q-021 | privileged account disablement evidence owner review log ticket runbook timeline | containment, isolation, segmentation, response, incident_response, dfir, readiness, privileged_access | 0 |
DFIR-Q-022 | endpoint quarantine actions evidence owner review log ticket runbook timeline | containment, isolation, segmentation, response, incident_response, dfir, readiness | 0 |
DFIR-Q-023 | containment approval trail evidence owner review log ticket runbook timeline | containment, isolation, segmentation, response, incident_response, dfir, readiness | 0 |
DFIR-Q-024 | containment verification checks evidence owner review log ticket runbook timeline | containment, isolation, segmentation, response, incident_response, dfir, readiness | 0 |
DFIR-Q-025 | malware removal evidence evidence owner review log ticket runbook timeline | eradication, remediation, patching, hardening, incident_response, dfir, readiness, evidence, forensics | 0 |
DFIR-Q-026 | credential reset evidence evidence owner review log ticket runbook timeline | eradication, remediation, patching, hardening, incident_response, dfir, readiness, evidence, forensics | 0 |
DFIR-Q-027 | patch deployment logs evidence owner review log ticket runbook timeline | eradication, remediation, patching, hardening, incident_response, dfir, readiness | 0 |
DFIR-Q-028 | hardening checklist outputs evidence owner review log ticket runbook timeline | eradication, remediation, patching, hardening, incident_response, dfir, readiness | 0 |
DFIR-Q-029 | vulnerability closure notes evidence owner review log ticket runbook timeline | eradication, remediation, patching, hardening, incident_response, dfir, readiness | 0 |
DFIR-Q-030 | persistence hunting artifacts evidence owner review log ticket runbook timeline | eradication, remediation, patching, hardening, incident_response, dfir, readiness | 0 |
DFIR-Q-031 | root cause remediation tickets evidence owner review log ticket runbook timeline | eradication, remediation, patching, hardening, incident_response, dfir, readiness | 0 |
DFIR-Q-032 | change management records evidence owner review log ticket runbook timeline | eradication, remediation, patching, hardening, incident_response, dfir, readiness, change_management | 0 |
DFIR-Q-033 | backup status evidence evidence owner review log ticket runbook timeline | recovery, backup, restore, continuity, incident_response, dfir, readiness, evidence, forensics | 0 |
DFIR-Q-034 | restore test reports evidence owner review log ticket runbook timeline | recovery, backup, restore, continuity, incident_response, dfir, readiness | 0 |
DFIR-Q-035 | service restoration runbooks evidence owner review log ticket runbook timeline | recovery, backup, restore, continuity, incident_response, dfir, readiness | 0 |
DFIR-Q-036 | business continuity checkpoints evidence owner review log ticket runbook timeline | recovery, backup, restore, continuity, incident_response, dfir, readiness | 0 |
DFIR-Q-037 | recovery communications evidence owner review log ticket runbook timeline | recovery, backup, restore, continuity, incident_response, dfir, readiness, communications | 0 |
DFIR-Q-038 | recovery validation metrics evidence owner review log ticket runbook timeline | recovery, backup, restore, continuity, incident_response, dfir, readiness | 0 |
DFIR-Q-039 | post-recovery monitoring evidence owner review log ticket runbook timeline | recovery, backup, restore, continuity, incident_response, dfir, readiness | 0 |
DFIR-Q-040 | customer impact closure notes evidence owner review log ticket runbook timeline | recovery, backup, restore, continuity, incident_response, dfir, readiness, communications | 0 |
DFIR-Q-041 | post-incident review minutes evidence owner review log ticket runbook timeline | postincident, lessons_learned, improvement, governance, incident_response, dfir, readiness | 0 |
DFIR-Q-042 | lessons learned register evidence owner review log ticket runbook timeline | postincident, lessons_learned, improvement, governance, incident_response, dfir, readiness | 0 |
DFIR-Q-043 | corrective action tracker evidence owner review log ticket runbook timeline | postincident, lessons_learned, improvement, governance, incident_response, dfir, readiness | 0 |
DFIR-Q-044 | policy update changelog evidence owner review log ticket runbook timeline | postincident, lessons_learned, improvement, governance, incident_response, dfir, readiness, change_management | 0 |
DFIR-Q-045 | control improvement backlog evidence owner review log ticket runbook timeline | postincident, lessons_learned, improvement, governance, incident_response, dfir, readiness | 0 |
DFIR-Q-046 | executive briefing records evidence owner review log ticket runbook timeline | postincident, lessons_learned, improvement, governance, incident_response, dfir, readiness | 0 |
DFIR-Q-047 | regulator/customer comms log evidence owner review log ticket runbook timeline | postincident, lessons_learned, improvement, governance, incident_response, dfir, readiness, communications | 0 |
DFIR-Q-048 | evidence retention decisions evidence owner review log ticket runbook timeline | postincident, lessons_learned, improvement, governance, incident_response, dfir, readiness, evidence, forensics | 0 |
Query Log
| query_id | query_text | tags | hits |
|---|---|---|---|
DFIR-Q-001 | incident response plan evidence owner review log ticket runbook timeline | preparation, planning, governance, readiness, incident_response, dfir | 0 |
DFIR-Q-002 | communications playbook evidence owner review log ticket runbook timeline | preparation, planning, governance, readiness, incident_response, dfir, communications | 0 |
DFIR-Q-003 | stakeholder contact list evidence owner review log ticket runbook timeline | preparation, planning, governance, readiness, incident_response, dfir | 0 |
DFIR-Q-004 | evidence handling standards evidence owner review log ticket runbook timeline | preparation, planning, governance, readiness, incident_response, dfir, evidence, forensics | 0 |
DFIR-Q-005 | chain-of-custody template evidence owner review log ticket runbook timeline | preparation, planning, governance, readiness, incident_response, dfir, evidence, forensics | 0 |
DFIR-Q-006 | escalation matrix evidence owner review log ticket runbook timeline | preparation, planning, governance, readiness, incident_response, dfir | 0 |
DFIR-Q-007 | training exercise records evidence owner review log ticket runbook timeline | preparation, planning, governance, readiness, incident_response, dfir | 0 |
DFIR-Q-008 | tabletop outcomes evidence owner review log ticket runbook timeline | preparation, planning, governance, readiness, incident_response, dfir | 0 |
DFIR-Q-009 | edr telemetry evidence evidence owner review log ticket runbook timeline | detection, analysis, triage, telemetry, incident_response, dfir, readiness, logging, monitoring, evidence, forensics | 0 |
DFIR-Q-010 | siem alert triage logs evidence owner review log ticket runbook timeline | detection, analysis, triage, telemetry, incident_response, dfir, readiness, logging, monitoring | 0 |
DFIR-Q-011 | incident classification records evidence owner review log ticket runbook timeline | detection, analysis, triage, telemetry, incident_response, dfir, readiness | 0 |
DFIR-Q-012 | forensic timeline notes evidence owner review log ticket runbook timeline | detection, analysis, triage, telemetry, incident_response, dfir, readiness | 0 |
DFIR-Q-013 | ioc tracking artifacts evidence owner review log ticket runbook timeline | detection, analysis, triage, telemetry, incident_response, dfir, readiness | 0 |
DFIR-Q-014 | time sync ntp evidence evidence owner review log ticket runbook timeline | detection, analysis, triage, telemetry, incident_response, dfir, readiness, evidence, forensics, time_sync | 0 |
DFIR-Q-015 | logging retention policy evidence owner review log ticket runbook timeline | detection, analysis, triage, telemetry, incident_response, dfir, readiness, logging, monitoring | 0 |
DFIR-Q-016 | admin account monitoring records evidence owner review log ticket runbook timeline | detection, analysis, triage, telemetry, incident_response, dfir, readiness, privileged_access | 0 |
DFIR-Q-017 | host isolation records evidence owner review log ticket runbook timeline | containment, isolation, segmentation, response, incident_response, dfir, readiness | 0 |
DFIR-Q-018 | network segmentation indicators evidence owner review log ticket runbook timeline | containment, isolation, segmentation, response, incident_response, dfir, readiness | 0 |
DFIR-Q-019 | access revocation logs evidence owner review log ticket runbook timeline | containment, isolation, segmentation, response, incident_response, dfir, readiness | 0 |
DFIR-Q-020 | temporary firewall changes evidence owner review log ticket runbook timeline | containment, isolation, segmentation, response, incident_response, dfir, readiness, change_management | 0 |
DFIR-Q-021 | privileged account disablement evidence owner review log ticket runbook timeline | containment, isolation, segmentation, response, incident_response, dfir, readiness, privileged_access | 0 |
DFIR-Q-022 | endpoint quarantine actions evidence owner review log ticket runbook timeline | containment, isolation, segmentation, response, incident_response, dfir, readiness | 0 |
DFIR-Q-023 | containment approval trail evidence owner review log ticket runbook timeline | containment, isolation, segmentation, response, incident_response, dfir, readiness | 0 |
DFIR-Q-024 | containment verification checks evidence owner review log ticket runbook timeline | containment, isolation, segmentation, response, incident_response, dfir, readiness | 0 |
DFIR-Q-025 | malware removal evidence evidence owner review log ticket runbook timeline | eradication, remediation, patching, hardening, incident_response, dfir, readiness, evidence, forensics | 0 |
DFIR-Q-026 | credential reset evidence evidence owner review log ticket runbook timeline | eradication, remediation, patching, hardening, incident_response, dfir, readiness, evidence, forensics | 0 |
DFIR-Q-027 | patch deployment logs evidence owner review log ticket runbook timeline | eradication, remediation, patching, hardening, incident_response, dfir, readiness | 0 |
DFIR-Q-028 | hardening checklist outputs evidence owner review log ticket runbook timeline | eradication, remediation, patching, hardening, incident_response, dfir, readiness | 0 |
DFIR-Q-029 | vulnerability closure notes evidence owner review log ticket runbook timeline | eradication, remediation, patching, hardening, incident_response, dfir, readiness | 0 |
DFIR-Q-030 | persistence hunting artifacts evidence owner review log ticket runbook timeline | eradication, remediation, patching, hardening, incident_response, dfir, readiness | 0 |
DFIR-Q-031 | root cause remediation tickets evidence owner review log ticket runbook timeline | eradication, remediation, patching, hardening, incident_response, dfir, readiness | 0 |
DFIR-Q-032 | change management records evidence owner review log ticket runbook timeline | eradication, remediation, patching, hardening, incident_response, dfir, readiness, change_management | 0 |
DFIR-Q-033 | backup status evidence evidence owner review log ticket runbook timeline | recovery, backup, restore, continuity, incident_response, dfir, readiness, evidence, forensics | 0 |
DFIR-Q-034 | restore test reports evidence owner review log ticket runbook timeline | recovery, backup, restore, continuity, incident_response, dfir, readiness | 0 |
DFIR-Q-035 | service restoration runbooks evidence owner review log ticket runbook timeline | recovery, backup, restore, continuity, incident_response, dfir, readiness | 0 |
DFIR-Q-036 | business continuity checkpoints evidence owner review log ticket runbook timeline | recovery, backup, restore, continuity, incident_response, dfir, readiness | 0 |
DFIR-Q-037 | recovery communications evidence owner review log ticket runbook timeline | recovery, backup, restore, continuity, incident_response, dfir, readiness, communications | 0 |
DFIR-Q-038 | recovery validation metrics evidence owner review log ticket runbook timeline | recovery, backup, restore, continuity, incident_response, dfir, readiness | 0 |
DFIR-Q-039 | post-recovery monitoring evidence owner review log ticket runbook timeline | recovery, backup, restore, continuity, incident_response, dfir, readiness | 0 |
DFIR-Q-040 | customer impact closure notes evidence owner review log ticket runbook timeline | recovery, backup, restore, continuity, incident_response, dfir, readiness, communications | 0 |
DFIR-Q-041 | post-incident review minutes evidence owner review log ticket runbook timeline | postincident, lessons_learned, improvement, governance, incident_response, dfir, readiness | 0 |
DFIR-Q-042 | lessons learned register evidence owner review log ticket runbook timeline | postincident, lessons_learned, improvement, governance, incident_response, dfir, readiness | 0 |
DFIR-Q-043 | corrective action tracker evidence owner review log ticket runbook timeline | postincident, lessons_learned, improvement, governance, incident_response, dfir, readiness | 0 |
DFIR-Q-044 | policy update changelog evidence owner review log ticket runbook timeline | postincident, lessons_learned, improvement, governance, incident_response, dfir, readiness, change_management | 0 |
DFIR-Q-045 | control improvement backlog evidence owner review log ticket runbook timeline | postincident, lessons_learned, improvement, governance, incident_response, dfir, readiness | 0 |
DFIR-Q-046 | executive briefing records evidence owner review log ticket runbook timeline | postincident, lessons_learned, improvement, governance, incident_response, dfir, readiness | 0 |
DFIR-Q-047 | regulator/customer comms log evidence owner review log ticket runbook timeline | postincident, lessons_learned, improvement, governance, incident_response, dfir, readiness, communications | 0 |
DFIR-Q-048 | evidence retention decisions evidence owner review log ticket runbook timeline | postincident, lessons_learned, improvement, governance, incident_response, dfir, readiness, evidence, forensics | 0 |