Skip to main content
MuonPartners
Services
Architecture

Solution design and technology roadmapping

Solution AssessmentTechnology RoadmapsIntegration DesignSolution ArchitectureTechnical Design
Cyber Security

Security assessments, IAM, and compliance

AssessmentsIAMComplianceSecurity BaselineCyber Innovation
Network and Platform

Network architecture and cloud platforms

Network DesignCloud StrategyModernisation
Enterprise Architecture

Business-technology alignment

Business AlignmentPortfolio AnalysisGovernance
View all services
ProjectsCase StudiesInsightsToolsAbout
Contact Us

Services

Architecture
Solution AssessmentTechnology RoadmapsIntegration DesignSolution ArchitectureTechnical Design
Cyber Security
AssessmentsIAMComplianceSecurity BaselineCyber Innovation
Network and Platform
Network DesignCloud StrategyModernisation
Enterprise Architecture
Business AlignmentPortfolio AnalysisGovernance
ProjectsCase StudiesInsightsToolsAboutContact
Get in Touch
MuonPartners

Strategic technology consulting for Australian organisations navigating complexity.

Services

  • Architecture
  • Cyber Security
  • Network and Platform
  • Enterprise Architecture

Company

  • About
  • Products
  • Frameworks
  • Cross-Framework Mapping
  • Projects
  • Case Studies
  • Insights
  • Contact

Contact

  • [email protected]
  • Australia
  • LinkedIn

© 2026 Muon Partners. All rights reserved.

ABN 50 669 022 315 · A Muon Group company.

Privacy PolicyTerms of Service
  1. Frameworks
  2. >C2M2
  3. >Event And Incident Response, Continuity Of Operations
  4. >Event And Incident Response, Continuity Of Operations - Objective 3
  5. >C2M2-RESPONSE-3E
C2M2-RESPONSE-3EActive

Cybersecurity incident response is executed according to defined plans and procedures

Statement

Cybersecurity incident response is executed according to defined plans and procedures

Location

Domain
Event and Incident Response, Continuity of Operations
Objective
Event and Incident Response, Continuity of Operations - Objective 3

Practice Details

Identifier
C2M2-RESPONSE-3E
Domain
Event and Incident Response, Continuity of Operations
Objective
Objective 3
Maturity Level
MIL-2

Help Text

The organization should execute incident response based on the defined plans and procedures. This may include responding to actual incidents or potential incidents due to major vulnerabilities. The organization should consider whether adequate resources will be available to perform the roles identified in the plan. This may require engaging with others prior to an incident to develop requests for technical assistance with law enforcement and government entities, mutual aid agreements with peer organizations, or contracts and retainers with vendors. These agreements may be prepared in advance to allow for immediate activation when response is needed. Additionally, it may be useful to pre-clear access for individuals providing response to avoid delays that may be caused by badging, access provisioning, and mandatory trainings. Following completion of response to an incident, the organization should conduct reviews or assessments to determine whether the defined plans and procedures are being followed effectively.

Related Practices · Progression: This practice is part of a practice progression. Practice progressions are groups of related practices that represent increasingly complete or more advanced implementations of an activity. The practices in this progression include: RESPONSE-3b, RESPONSE-3e, RESPONSE-3h, RESPONSE-3i, RESPONSE-3l.

AESCSF
AESCSF-RESPONSE-3eequivalentvia derived-shared-practice-structure
View in graphReport an issue
← Back to Event and Incident Response, Continuity of Operations - Objective 3
Event and Incident Response, Continuity of Operations - Objective 312 controls
C2M2-RESPONSE-3ACybersecurity incident response personnel are identified, and roles are assigned, at least in an ad hoc mannerC2M2-RESPONSE-3BResponses to cybersecurity incidents are executed, at least in an ad hoc manner, to limit impact to the function and restore normal operationsC2M2-RESPONSE-3CReporting of incidents is performed (for example, internal reporting, ICS-CERT, relevant ISACs), at least in an ad hoc mannerC2M2-RESPONSE-3DCybersecurity incident response plans that address all phases of the incident lifecycle are established and maintainedC2M2-RESPONSE-3ECybersecurity incident response is executed according to defined plans and proceduresC2M2-RESPONSE-3FCybersecurity incident response plans include a communications plan for internal and external stakeholdersC2M2-RESPONSE-3GCybersecurity incident response plan exercises are conducted periodically and according to defined triggers, such as system changes and external eventsC2M2-RESPONSE-3HCybersecurity incident lessons-learned activities are performed and corrective actions are taken, including updates to the incident response planC2M2-RESPONSE-3ICybersecurity incident root-cause analysis is performed and corrective actions are taken, including updates to the incident response planC2M2-RESPONSE-3JCybersecurity incident responses are coordinated with vendors, law enforcement, and other external entities as appropriate, including support for evidence collection and preservationC2M2-RESPONSE-3KCybersecurity incident response personnel participate in joint cybersecurity exercises with other organizationsC2M2-RESPONSE-3LCybersecurity incident responses leverage and trigger predefined states of operation (SITUATION-3g)