What this control covers
Plan and prepare for incidents related to PII processing with defined processes, roles and responsibilities. Implementation: Define incident procedures, roles and notification requirements. Justification: Enables timely and effective breach response.
Why it matters
How quickly and methodically you contain an incident determines the regulatory consequence — most fines are not for the breach itself but for the slow or absent response.
How to implement
AWS
Wire GuardDuty, Security Hub and Macie findings into your ticketing/SIEM via EventBridge. Maintain documented playbooks for IAM-key compromise, EC2 instance compromise, S3 data exposure, and run quarterly tabletop exercises.
Azure
Use Defender for Cloud + Microsoft Sentinel with playbooks (Logic Apps) for automated containment — disable user, isolate VM (NSG), revoke session tokens. Keep an on-call rotation in Teams with PagerDuty.
GCP
Use Cloud KMS with customer-managed encryption keys (CMEK) for BigQuery, GCS, and Compute. Sensitive Data Protection (DLP API) inspects/de-identifies PII at scale.
Google Workspace
Enable client-side encryption for Drive/Docs and turn on Drive Labels + DLP rules to prevent external sharing of regulated data classes.
GitHub
Subscribe to secret-scanning alerts and Dependabot security advisories; require triage SLAs by severity. For exposed secrets, rotate at the cloud provider FIRST then revoke at GitHub — order matters.
Evidence to collect
infra_scan— See the iCompaas Evidence library for the canonical source for this evidence type.ticketing_workflow— See the iCompaas Evidence library for the canonical source for this evidence type.policy_document— A signed, version-controlled policy stating leadership intent and the named owner.
Signed policies, procedures, and registers document the safeguard. Infrastructure posture tooling (AWS/Azure/GCP configuration, encryption, backup, logging) verifies technical enforcement. Service management or request-handling tickets prove timely handling. Focus: Incident management planning.
Quick checklist
- Implement — Incident Management Planning
- Define — Incident Management Planning
- Process — Incident Management Planning
Related articles on this site
- Roles and responsibilities
- NIST 800-171 3.2.1 Ensure that managers, systems administrators, and users of organizational systems are made aware of the security risks associated with their activities and of the applicable policies, standards, and procedures related to
- NIST 800-171 3.2.2 Ensure that personnel are trained to carry out their assigned information security-related duties and responsibilities.
- NIST 800-171 3.3.4 Alert in the event of an audit logging process failure.