# CIS Controls v8 17.9 — Establish and Maintain Security Incident Thresholds - Source: https://support.icompaas.com/compliance/cis-controls-v8/17-9-establish-and-maintain-security-incident-thresholds - Section: [Compliance](https://support.icompaas.com/compliance) › [CIS Critical Security Controls v8](https://support.icompaas.com/compliance/cis-controls-v8) › Control 17 — Incident Response Management - Last updated: 2026-06-05 - Publisher: iCompaas, Inc. (https://www.icompaas.com) **CIS Controls v8**·Control `17.9`·medium·Component: **Recover** ## What this control requires > Establish and maintain security incident thresholds, including, at a minimum, differentiating between an incident and an event. Examples can include: abnormal activity, security vulnerability, security weakness, data breach, privacy incident, etc. Review annually, or when significant enterprise changes occur that could impact this Safeguard. > > — CIS Controls v8, Control 17.9 ### In plain English Establish and maintain security incident thresholds, including, at a minimum, differentiating between an incident and an event. In practice, this means you can prove you establish and maintain data-level controls on a defined cadence. ## Why it matters The CIS Controls are an industry-vetted, prioritised defence: skipping a safeguard widens the attack surface that the safeguards above and below it assume is closed. Audit frameworks (FedRAMP, PCI DSS, HIPAA) all cite CIS as evidence of due care. ## What an auditor looks for A CIS-aligned reviewer wants to see (a) which Implementation Group you are targeting, (b) a documented owner for the safeguard, and (c) a tooling or process artefact (config, scan output, ticket) that proves the safeguard runs on the cadence the control demands. Within **Recover**, the assessor will trace your implementation back to the catalogue reference (Control 17.9) and look for objective evidence on the latest two assessment cycles. ## How to implement #### Incident Response **Runbook.** Maintain a runbook keyed by incident type with named roles (IC, comms, scribe), an out-of-band comms channel, and a 72-hour timeline for external notification. **Tabletop.** Run a quarterly tabletop exercise (ransomware, insider, supply-chain) and feed gaps back into the runbook. #### Logging Monitoring **AWS.** Org-trail CloudTrail to a central log archive account, GuardDuty in every region, and Security Hub for cross-source correlation. **Azure.** Pipe every diagnostic setting into a central Log Analytics workspace; onboard Microsoft Sentinel for SIEM/SOAR. **GCP.** Aggregate audit logs in a dedicated logging project with sink to BigQuery; enable Security Command Center Premium and route findings to Chronicle SIEM. ### Operational checklist - **Establish And Maintain.** Document the trigger, the owner and the cadence. - **Scope:** data, vulnerability, response, security incident, security incident thresholds, enterprise. ## Evidence to collect - **Ticketing Workflow.** `ticketing_workflow` evidence Workflow metrics (ServiceNow, Jira) show approvals and remediation. Focus: Establish and Maintain Security Incident Thresholds. ## Common pitfalls - Runbooks that name a role but no person, or list a paging channel that no longer exists. - Per-account logging that nobody stitches together at the org level — incidents that cross accounts go undetected for days. ## How it maps to other frameworks Computed from shared tags, control component and key-operation subjects — handy when you are reconciling controls across an audit. - [**SOC 2 (2017 TSC) P6.3** — Logging and Retention of Unauthorized Disclosure Incidents](https://support.icompaas.com/compliance/soc-2-trust-services-criteria/p6-3-logging-and-retention-of-unauthorized-disclosure-incidents) - [**NIST SP 800-171 Rev. 3 3.6.2** — Incident Monitoring, Reporting, and Response Assistance](https://support.icompaas.com/compliance/nist-sp-800-171-rev-3/3-6-2-incident-monitoring-reporting-and-response-assistance) - [**BSI C5:2020 SIM-04** — Duty of the users to report security incidents to a central body](https://support.icompaas.com/compliance/bsi-c5-2020/sim-04-duty-of-the-users-to-report-security-incidents-to-a-central-body) - [**NIST SP 800-53 Rev. 5 AT-2(1)** — Practical Exercises](https://support.icompaas.com/compliance/nist-sp-800-53-rev-5/at-2-1-practical-exercises) ## Related controls in CIS Controls v8 - [**Control 11.2** — Perform Automated Backups](https://support.icompaas.com/compliance/cis-controls-v8/11-2-perform-automated-backups) - [**Control 17.8** — Conduct Post-Incident Reviews](https://support.icompaas.com/compliance/cis-controls-v8/17-8-conduct-post-incident-reviews) - [**Control 17.6** — Define Mechanisms for Communicating During Incident Response](https://support.icompaas.com/compliance/cis-controls-v8/17-6-define-mechanisms-for-communicating-during-incident-response) - [**Control 11.5** — Test Data Recovery](https://support.icompaas.com/compliance/cis-controls-v8/11-5-test-data-recovery) - [**Control 17.4** — Establish and Maintain an Incident Response Process](https://support.icompaas.com/compliance/cis-controls-v8/17-4-establish-and-maintain-an-incident-response-process) - [**Control 17.7** — Conduct Routine Incident Response Exercises](https://support.icompaas.com/compliance/cis-controls-v8/17-7-conduct-routine-incident-response-exercises) ## References - [Center for Internet Security — CIS Controls v8](https://www.cisecurity.org/controls/v8) - Catalogue identifier: `Control 17.9` Topics: incident responsechange managementlogging monitoringprivacy management ## Related compliance guidance - [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them. - [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.