How to Audit Incident Management - Top 10 audit check points (2020)

Incident management involves returning

service

to normal as soon as possible after an

incident has occurred

in an organization. Hello and Welcome to

Information Security Governance

Risk and Compliance. My name is Salvadore

Vaz,

and today we will learn how to audit an

Incident management process

in an organization in 10 steps.

Let's get started.

Point # 1, check and verify if

there is an incident management policy

defined,

approved and reviewed regularly. Make

sure that it contains

incident response plans, rules and

responsibilities escalation metrics etc.

Point # 2. Check and verify if

security incidents and events are locked

to an SIEM solution,

And incident response and resolution is

defined and implemented. Also make sure

that the incident responders are

well trained to handle the incidents and

make sure that there is a way or

mechanism

to report incidents by employees.

Point # 3, check and verify if

the incidents are locked in an

application

for better tracking ensure all the

details of the incidents are locked and

captured properly

and ensure if the organization has a

known error database

for easy reference.

Point # 4, make sure that the

incidents are evaluated

and analyzed on the criticality and

severity such as high

medium or low.

Point # 5, check and verify if

the incidents are

prioritized based on the impact on the

organization

and adequate resources are aligned to

resolve it.

Point # 6, check and verify if the

incidents are followed up for updates

and closures and escallations are made if

necessary.

Point # 7, check and verify that

all the critical incidents

are reported to management resolved and

closed.

Point # 8, check and verify the

time to respond and time to resolve

of a few sample incidents to check if

the SLAs are met.

Point # 9, check and verify if

all the evidences are collected and

stored in a secure place

additionally check and verify if Root

Cause Analysis is performed of the

incidents

and learnings from the incidents are

derived for future reference

and finally point # 10, ensure the

compliance of regulatory or statutory

requirements

for reporting an incident or security

breach.

Do share the video and provide your

feedback, Thank you for watching!