Unit of competency Outline

Date retreived
22/07/2026 2:00 PM AWST

Whilst all efforts are made to provide accurate and timely information from the relevant source/documentation, please be aware that the information supplied may not be the most current version. The accuracy of the detail has not been confirmed by the Department and therefore should not be relied upon without first confirming the contents.

Develop, implement and evaluate an incident response plan

Develop, implement and evaluate an incident response plan

Unit of competency
National Code
ICTSAS524
State Code
OBS47
TGA Status
Current
DTWD Status
Approved
Current Release Number
1.00
Current Release Date
21/07/2020
View on TGA
State Implementation and Classification
Approved Date
15/01/2021
Field of Education
020113 - Networks And Communications
Original Release Date
15/01/2021
Nominal Hours
25
Description
This unit describes the skills and knowledge required to develop and implement an incident response plan. The results of the incident response plan must be evaluated if they affect the mission of the organisation.It applies to individuals who apply high-level technical skills and specialised knowledge to provide broad systems administration and support functions.No licensing, legislative or certification requirements apply to this unit at the time of publication.
Notes
Elements and Performance Criteria
1. Prepare to develop an incident response plan
  • 1.1 Identify and document organisational incident response plan requirements
  • 1.2 Identify and document incident response team services according to organisational requirements
  • 1.3 Identify incident response plan structure according to organisational requirements
  • 1.4 Determine and document alignment of organisation’s existing incident response plan against identified requirements
  • 1.5 Submit documentation to required personnel, seek and respond to feedback
2. Develop the incident response plan
  • 2.1 Develop and document incident management policy according to task requirements
  • 2.2 Create incident response plans according to organisational requirements and security policies and procedures
  • 2.3 Develop incident handling and reporting procedures
  • 2.4 Create incident response exercises, red-teaming activities, staffing and training requirements
  • 2.5 Develop procedure for collecting and protecting forensic evidence during incident response procedures according to organisational requirements
  • 2.6 Establish and document incident the response plan
3. Implement the incident response plan
  • 3.1 Apply response actions to reported security incident according to incident response plan and task requirements
  • 3.2 Assist in collecting, processing and preserving evidence according to requirements
  • 3.3 Execute incident response plans, red-teaming activities and incident response exercises
  • 3.4 Document security incident response and actions according to task requirements
  • 3.5 Collect, analyse and report incident management measures according to task requirements
4. Evaluate incident response plans
  • 4.1 Assess and document efficiency and effectiveness of incident response plans activities
  • 4.2 Examine and document effectiveness of red teaming and incident response tests, training and exercises
  • 4.3 Assess effectiveness of communication between incident response team and required internal and external organisations
  • 4.4 Determine and document response improvement activities
  • 4.5 Submit documentation to required personnel and obtain final task sign off
No information
No information
Replaces
State Code National Code Title Type
AUW66 ICTSAS501 Develop, implement and evaluate an incident response plan Unit of competency