GB/T 20985.2-2020 Active

This part of GB/T 20985 is based on the "Planning and Preparation" phase and the "Lessons Learned" phase of the "Information Security Incident Management Phases" model given in GB/T 20985.1—2017, and provides guidelines for planning and preparing for incident response, as well as summarizing lessons learned and making improvements after an incident.
The key points of the "Planning and Preparation" phase include:
——Information security incident management strategies and the commitment of top management;
——Updating information security strategies at the company level and at the system, service, and network levels, including those related to risk management;
——An information security incident management plan;
——Establishing an incident response team (IRT);
——Establishing relationships and contacts with internal and external organizations;
——Providing technical and other support (including organizational and operational aspects);
——Awareness education and training in information security incident management;
——Testing the information security incident management plan.
The key points of the "Lessons Learned" phase include:
——Summarizing lessons learned;
——Summarizing and improving information security;
——Summarizing and improving the results of risk assessment and management reviews for information security;
——Summarizing and improving the information security incident management plan;
——Evaluating the performance and effectiveness of the IRT.
The principles presented in this part are universal and applicable to organizations of any type, size, or nature. Organizations can adjust the guidelines provided in this part based on the type, size, and nature of their business and the associated information security risk situation. This part is also applicable to external organizations that provide information security incident management services.