Cybersecurity buying research| Situation | First action | What comes next | Who should own it |
|---|---|---|---|
| Suspected active compromise | Use the established incident process and appropriate responders | Preserve the factual timeline; coordinate authorized investigation and business decisions | Incident leader with counsel and operations as needed |
| Renewal within six months | Verify contract and notice dates | Reconcile scope, compare current service with alternatives | Contract owner and IT/security lead |
| No clear security owner | Name an accountable sponsor | Decide what leadership and execution capacity is missing | Executive sponsor |
| Customer, insurer or regulator asks for evidence | Obtain the exact request and applicable scope | Map evidence to truthful representations and owners | Compliance/legal owner with IT |
| Recovery capability is uncertain | Assign a business-service owner | Plan an authorized restore exercise and dependency review | Operations/application owner |
| Unknown exploitable exposure | Define the asset and business question | Obtain a safely scoped test and remediation plan | Technical owner |
An incident should not wait for this procurement exercise. The lifecycle context in NIST's response guidance is useful, but an actual incident needs the organization's established contacts and facts.
Working view: explore the first table
Situation
Suspected active compromise
- First action
- Use the established incident process and appropriate responders
- What comes next
- Preserve the factual timeline; coordinate authorized investigation and business decisions
- Who should own it
- Incident leader with counsel and operations as needed
Sources cited on this page
- NIST's response guidance ↗csrc.nist.gov