Sekit CSF · Incident Response · Process
RCF-0266Playbooks
Playbooks are consistently followed during incidents and kept current with lessons learned
Mapping at a glance
RCF-0266PlaybooksIncident Response · Process
A.5.24Information security incident management planning and preparationISO/IEC 27001:2022A.5.26Response to information security incidentsISO/IEC 27001:2022A.5.27Learning from information security incidentsISO/IEC 27001:2022RS.MA-02Incident reports triagedNIST CSF 2.0RS.MA-03Incidents categorized and prioritizedNIST CSF 2.0
RCF-0266 maps to 6 controls across the published frameworks. +1 more in the table below. Open in the full graph →
Maps to ISO/IEC 27001:2022
Curated mapping with the reasoning, not just the codes.
A.5.24Information security incident management planning and preparationsupportsUpdating playbooks with lessons learned after each activation keeps the preparation work in this control current instead of a one-time document.A.5.26Response to information security incidentssupportsFollowing the playbooks during real incidents is one operational piece of this control's response behavior, which also spans containment, escalation and notification beyond playbook execution alone.A.5.27Learning from information security incidentssupportsUpdating playbooks with lessons learned after each activation covers one type of improvement this control asks for, not the full range of incident knowledge A.5.27 expects to feed back into controls.
Maps to NIST CSF 2.0
Curated mapping with the reasoning, not just the codes.
RS.MA-02Incident reports triagedRS.MA-03Incidents categorized and prioritizedRS.MA-04Incidents escalated
Evidence that proves this control
What an auditor, or Sekit's evidence engine, asks for.
Incident playbooks, exercises and forensics readiness
The step-by-step guides for the most likely incidents, the tabletop exercises, the post-incident review reports, and how evidence is preserved so an incident can be investigated.
From the Sekit evidence catalog
This topic through the other lenses
All Incident Response controls
Ask Sekura: “What evidence proves RCF-0266?”
Also via MCP, free with account