Respond · Established tier · Security Operations

RS-01Incidents reach BSP within 2 hours

Major cyber incidents are notified to BSP within 2 hours of discovery and followed up within 24 hours, and the response plan is exercised.

Status

Evidence indicates

All 2 items support it and are fresh.

Exposure

Critical

2 evidence items from 2 sources

CCSA · Respond

Managed

Not blocking this domain's next tier.

Evidence chain

Every item is read-only, dated, hashed and re-runnable. This is what an examiner can test.

ev-rs01-1

All 3 reportable incidents reached BSP within 2 hours (median 58 minutes)

ServiceNow ITSM · export · collected 12 h ago (Oct 15, 2026 · 03:02 UTC) · limit 365 days

Supports

Query: GET /api/now/table/sn_si_incident?sysparm_query=u_bsp_reportable=true
Identity: oauth app assurance-ro (table ACL: read)
Collector: servicenow-collector 2.0.3
Window: 8760 h
Records: 3
SHA-256: f7cc8acb5e91df6776d440c449b56d835772940428e6ca88687ff0a889af85e9

ev-rs01-2

Executives exercised the response plan in a ransomware tabletop

Uploaded Document · document · collected 38 days ago (Sep 8, 2026 · 03:02 UTC) · limit 365 days

Supports