Develop and implement responses to declared incidents according to predefined procedures.

By documenting incident responses for common incidents can quickly respond to incidents as they occur.

Document procedures for responding to common security incidents. Common security incidents include phishing attacks, malware infections, and policy violations by employees. Responses to incidents generally include actions to contain damage, communicating the incident to users, deploying additional security controls and communicating with key stakeholders.