AzPolicyAdvertizer

last sync: 2025-Apr-29 17:16:02 UTC

Microsoft Managed Control 1365 - Incident Handling | Continuity Of Operations | Regulatory Compliance - Incident Response

Azure BuiltIn Policy definition

Source Azure Portal
Display name Microsoft Managed Control 1365 - Incident Handling | Continuity Of Operations
Id 4116891d-72f7-46ee-911c-8056cc8dcbd5
Version 1.0.0
Details on versioning
Versioning Versions supported for Versioning: 0
Built-in Versioning [Preview]
Category Regulatory Compliance
Microsoft Learn
Description Microsoft implements this Incident Response control
Cloud environments AzureCloud = true
AzureUSGovernment = true
AzureChinaCloud = unknown
Available in AzUSGov The Policy is available in AzureUSGovernment cloud. Version: '1.0.0'
Repository: Azure-Policy 4116891d-72f7-46ee-911c-8056cc8dcbd5
Additional metadata Name/Id: ACF1365 / Microsoft Managed Control 1365
Category: Incident Response
Title: Incident Handling | Continuity Of Operations
Ownership: Customer, Microsoft
Description: The organization identifies Incident classes identified in the Microsoft Azure Incident Response Plan; Incident classes which can be mapped to those defined in CJCSM 6510.01B and Actions defined in the Microsoft Azure Incident Response Plan (SOP) to ensure continuation of organizational missions and business functions.
Requirements: The Azure Incident Management SOP identifies classes of incidents and defines actions to take in response to those classes of incidents to ensure continuation of organizational missions and business functions. The SOP describes the incident handling process for all incidents. The incident handling process consists of the following stages: 1. Detect - identify anomalous or suspicious activity and initiate the incident management process. 2. Assess - triage the issue to determine initial severity and ownership. 3. Diagnose - troubleshoot and classify the event. 4. Stabilize & Recover - perform mitigation and repair. 5. Close - perform post-incident analysis and reporting, and adjust incident management procedures as needed.
Mode Indexed
Type Static
Preview False
Deprecated False
Effect Fixed
audit
RBAC role(s) none
Rule aliases none
Rule resource types IF (2)
Compliance
The following 3 compliance controls are associated with this Policy definition 'Microsoft Managed Control 1365 - Incident Handling | Continuity Of Operations' (4116891d-72f7-46ee-911c-8056cc8dcbd5)
Control Domain Control Name MetadataId Category Title Owner Requirements Description Info Policy#
NIS2 BR._Backup_and_Recovery_3 NIS2_BR._Backup_and_Recovery_3 NIS2_BR._Backup_and_Recovery_3 BR. Backup and Recovery Business continuity and crisis management n/a Directive (EU) 2016/1148 of the European Parliament and the Council (4) aimed to build cybersecurity capabilities across the Union, mitigate threats to network and information systems used to provide essential services in key sectors and ensure the continuity of such services when facing incidents, thus contributing to the Union’s security and to the effective functioning of its economy and society. 25
NIS2 IR._Incident_Response_2 NIS2_IR._Incident_Response_2 NIS2_IR._Incident_Response_2 IR. Incident Response Incident handling n/a Where essential or important entities become aware of a significant incident, they should be required to submit an early warning without undue delay and in any event within 24 hours. That early warning should be followed by an incident notification. The entities concerned should submit an incident notification without undue delay and in any event within 72 hours of becoming aware of the significant incident, with the aim, in particular, of updating information submitted through the early warning and indicating an initial assessment of the significant incident, including its severity and impact, as well as indicators of compromise, where available. A final report should be submitted not later than one month after the incident notification. The early warning should only include the information necessary to make the CSIRT, or where applicable the competent authority, aware of the significant incident and allow the entity concerned to seek assistance, if required. Such early warning, where applicable, should indicate whether the significant incident is suspected of being caused by unlawful or malicious acts, and whether it is likely to have a cross-border impact. Member States should ensure that the obligation to submit that early warning, or the subsequent incident notification, does not divert the notifying entity’s resources from activities related to incident handling that should be prioritised, in order to prevent incident reporting obligations from either diverting resources from significant incident response handling or otherwise compromising the entity’s efforts in that respect. 27.12.2022 EN Official Journal of the European Union L 333/99 In the event of an ongoing incident at the time of the submission of the final report, Member States should ensure that entities concerned provide a progress report at that time, and a final report within one month of their handling of the significant incident 34
op.exp.7 Incident management op.exp.7 Incident management 404 not found n/a n/a 103
Initiatives usage
Initiative DisplayName Initiative Id Initiative Category State Type polSet in AzUSGov
[Preview]: NIS2 32ff9e30-4725-4ca7-ba3a-904a7721ee87 Regulatory Compliance Preview BuiltIn unknown
Spain ENS 175daf90-21e1-4fec-b745-7b4c909aa94c Regulatory Compliance GA BuiltIn unknown
History none
JSON compare n/a
JSON
api-version=2021-06-01
EPAC