Include the magnitude of the incident in the incident response report.

CONTROL ID
12722

CONTROL TYPE
Establish/Maintain Documentation

CLASSIFICATION
Preventive

This Control directly supports the implied Control(s):

Create an incident response report following an incident response., CC ID: 12700

There are no implementation support Controls.

Magnitude of the incident including foregone revenue, losses, costs, investments, number of customers affected, implications, consequences to reputation and confidence; and (§ 7.3.12.b.ii., Monetary Authority of Singapore: Technology Risk Management Guidelines)
where applicable, the cross-border impact of the incident; (Article 23 4 ¶ 1(d)(iv), DIRECTIVE (EU) 2022/2555 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL of 14 December 2022 on measures for a high common level of cybersecurity across the Union, amending Regulation (EU) No 910/2014 and Directive (EU) 2018/1972, and repealing Directive (EU) 2016/1148 (NIS 2 Directive))
a detailed description of the incident, including its severity and impact; (Article 23 4 ¶ 1(d)(i), DIRECTIVE (EU) 2022/2555 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL of 14 December 2022 on measures for a high common level of cybersecurity across the Union, amending Regulation (EU) No 910/2014 and Directive (EU) 2018/1972, and repealing Directive (EU) 2016/1148 (NIS 2 Directive))
The cause of the breach, including the relationship between the person or entity that experienced the breach and the person responsible for the breach, if known; (§ 28?3852. (b-1)(6), Code of the District of Columbia Title 28 Chapter 38 Subchapter II, Consumer Security Breach Notification)