74-2.005. Respond

The respond function of the FCS is visually represented as such:

Function	Category	Subcategory
Respond (RS)	Response Planning (RP)	RS.RP-1: Execute response plan during or after an incident
	Communications (CO)	RS.CO-1: Ensure that personnel know their roles and order of operations when a response is needed
		RS.CO-2: Report incidents consistent with established criteria
		RS.CO-3: Share information consistent with response plans
		RS.CO-4: Coordinate with stakeholders consistent with response plans
		RS.CO-5: Engage in voluntary information sharing with external stakeholders to achieve broader cybersecurity situational awareness
	Analysis (AN)	RS.AN-1: Investigate notifications from detection systems
		RS.AN-2: Understand the impact of incidents
		RS.AN-3: Perform forensic analysis
		RS.AN-4: Categorize incidents consistent with response plans
		RS.AN-5: Establish processes to receive, analyze, and respond to vulnerabilities disclosed to the agency from internal and external sources
	Mitigation (MI)	RS.MI-1: Contain incidents
		RS.MI-2: Mitigate incidents
		RS.MI-3: Mitigate newly identified vulnerabilities or document accepted risks
	Improvements (IM)	RS.IM-1: Incorporate lessons learned in response plans
		RS.IM-2: Periodically update response strategies

(1) Response Planning. Each agency shall establish and maintain response processes and procedures and validate execution capability to ensure agency response for detected cybersecurity incidents. Each agency shall execute a response plan during or after an incident (RS.RP-1).

(a) Agencies shall establish a Computer Security Incident Response Team (CSIRT) to respond to cybersecurity incidents. CSIRT members shall convene immediately, upon notice of cybersecurity incidents. Responsibilities of CSIRT members include:

1. Convening a simple majority of CSIRT members at least quarterly to review, at a minimum, established processes and escalation protocols.

2. Receiving incident response training annually. Training shall be coordinated as a part of the information security program.

3. CSIRT membership shall include, at a minimum, a member from the information security team, the CIO (or designee), and a member from the Inspector General’s Office who shall act in an advisory capacity. The CSIRT team shall report findings to agency management.

4. The CSIRT shall determine the appropriate response required for each cybersecurity incident.

5. The agency security incident reporting process must include notification procedures, established pursuant to section 501.171, F.S., section 282.318, F.S., and as specified in executed agreements with external parties. For reporting incidents to AST and the Cybercrime Office (as established within the Florida Department of Law Enforcement via section 943.0415, F.S.), agencies shall report observed incident indicators via the AST Incident Reporting Portal to provide early warning and proactive response capability to other State of Florida agencies. Such indicators may include any known attacker IP addresses, malicious uniform resource locator (URL) addresses, malicious code file names and/or associated file hash values.

(2) Communications. Each agency shall coordinate response activities with internal and external stakeholders, as appropriate, to include external support from law enforcement agencies. Each agency shall:

(a) Inform workers of their roles and order of operations when a response is needed (RS.CO-1).

(b) Require that incidents be reported consistent with established criteria and in accordance with agency incident reporting procedures. Criteria shall require immediate reporting, including instances of lost identification and authentication resources (RS.CO-2).

(c) Share information, consistent with response plans (RS.CO-3).

(d) Coordinate with stakeholders, consistent with response plans (RS.CO-4).

(e) Establish communications with external stakeholders to share and receive information to achieve broader cybersecurity situational awareness (RS.CO-5). Where technology permits, enable automated security alerts. Establish processes to receive, assess, and act upon security advisories.

(3) Analysis. Each agency shall conduct analysis to adequately respond and support recovery activities. Related activities include:

(a) Each agency shall establish notification thresholds and investigate notifications from detection systems (RS.AN-1).

(b) Each agency shall assess and identify the impact of incidents (RS.AN-2).

(c) Each agency shall perform forensics, where deemed appropriate (RS.AN-3).

(d) Each agency shall categorize incidents, consistent with response plans (RS.AN-4). Each incident report and analysis, including findings and corrective actions, shall be documented.

(e) Establish processes to receive, analyze and respond to vulnerabilities disclosed to the organization from internal and external sources (RS.AN-5).

(4) Mitigation. Each agency shall perform incident mitigation activities. The objective of incident mitigation activities shall be to: attempt to contain and prevent recurrence of incidents (RS.MI-1); mitigate incident effects and resolve the incident (RS.MI-2); and address vulnerabilities or document as accepted risks.

(5) Improvements. Each agency shall improve organizational response activities by incorporating lessons learned from current and previous detection/response activities into response plans (RS.IM-1). Agencies shall update response strategies in accordance with agency-established policy (RS.IM-2).

Rulemaking Authority 282.318(5) FS. Law Implemented 282.318(3) FS. History‒New 3-10-16, Amended 1-2-19.