top of page

I05

Containment & Incident Response

Incident response includes agent-specific steps: credential revocation, memory quarantine and tool disconnection.

WHAT IT ADDRESSES

Standard IR does not remove agent persistence.

VERIFICATION METHOD

Playbook review and tabletop exercise.

OWASP T&M

bottom of page