RS.MA-01 - Executing the Incident Response Plan

RS.MA-01 initiates the execution of the incident response plan in coordination with third parties—like outsourcers or suppliers—once an incident is confirmed. This includes designating an incident lead and activating additional plans (e.g., business continuity) as needed to support response efforts. It ensures a structured, collaborative approach to managing incidents.

This subcategory aligns response actions with organizational and external capabilities, leveraging automation or external assistance for efficiency. It minimizes disruption by integrating third-party roles into the response framework, enhancing effectiveness. RS.MA-01 sets the stage for a unified incident handling process.