A.16.1.7: Collection of Evidence
Define and apply procedures for the identification, collection, acquisition, and preservation of information, which can serve as evidence.
A.16.1.6: Learning from Information Security Incidents
Collect and use information about information security incidents to improve the response process.
A.16.1.5: Response to Information Security Incidents
Respond to information security incidents in accordance with the documented procedures.
A.16.1.4: Assessment of and Decision on Information Security Events
Assess information security events and decide if they are to be classified as information security incidents.
A.16.1.2: Reporting Information Security Events
Ensure that information security events are reported through appropriate management channels as quickly as possible.