Policy Advisory  Information Security Incident Management Standard

Date:	01/01/2025
Organization:	Cybersecurity and Enterprise Risk Management
Referenced Sources:	MGL Chapter 7D, Section 2

The Information Security Incident Management Standard reinforces the Commonwealth’s commitment to an incident management strategy and outlines the controls necessary to safeguard the Commonwealth’s information assets and reduce risks.

Purpose

This standard documents the requirements for managing an information security incident; describes the actions to be taken should an incident occur; and details each phase of the incident management life cycle, including identification, investigation, response, and remediation.