Chapter 7: Roles and Responsibilities During an Incident

1. (2)
   The mission specified by NIST is the organization's mission. The organization's mission will dictate which actions cannot be taken; that is, the boundaries within which the CSIRT can operate. The IT team mission is important, but the incident response capability is owned by the organization as a whole, rather than the IT department specifically. The CSIRT mission will guide the team's priorities, but it is the organization's priorities that inform the CSIRT's actions, not the other way around.
2. (1)
   The NIST guidelines specify that metrics are required to measure the effectiveness of the plan. The incident response plan will be designed for a number of different eventualities, from benign to severe. Risk is assessed as part of the preparation phase, and will be accepted when it passes through...