Statement 39: Establish incident resolution processes
Agencies must
Criterion 140: Define incident handling processes.
This involves establishing a structured process for incident management that ensures identified incidents are allocated a severity level and addressed promptly and effectively. This includes security incident, reporting, and monitoring.
This must comply with the Australian Government Protective Security Policy Framework (PSPF) and the Information security manual (ISM).
Criterion 141: Implement corrective and preventive actions for incidents.
This includes:
- defining clear protocols for root cause analysis, implementing corrective actions, and preventive actions
- maintaining detailed logs and documentation to facilitate troubleshooting, provide input into longer term problem management, and assist continuous improvement of AI systems.