Title: Propose incident response procedures.
Course: Cybersecurity in Manufacturing, Advanced (13002-IV) > Section: Applying System Security Procedures and Risk Management in Automated Production Processes

Proposal should include the following:

- Incident symptoms
- Classification of incidents
- Incident response plan:
  - Documented incident types/category definitions
  - Roles and responsibilities
  - Reporting requirements, both internal and external (e.g., Occupational Safety and Health Administration [OSHA], Environmental Protection Agency [EPA], Food and Drug Administration [FDA], product recall requirements)
  - Cyber-incident response teams
  - Exercise/drill/simulation

- Incident response process:
  - Preparation
  - Detection and analysis
  - Containment
  - Eradication
  - Recovery
  - Lessons learned

Process/Skill Questions:

- What is the difference between an incident response plan and an incident response process?
- Why is it important to have incident response exercises?