Respond · Managed tier · Security Operations

RS-02Response is measured and partly automated

Containment time is measured, and high-severity detections have automated containment playbooks that a person approves.

Status

Evidence indicates

All 2 items support it and are fresh.

Exposure

Medium

2 evidence items from 2 sources

CCSA · Respond

Managed

Not blocking this domain's next tier.

Evidence chain

Every item is read-only, dated, hashed and re-runnable. This is what an examiner can test.

ev-rs02-1

Median containment time is 48 minutes across 1,975 alerts

ServiceNow ITSM · telemetry · collected 12 h ago (Oct 15, 2026 · 03:02 UTC) · limit 30 days

Supports

Query: GET /api/now/table/sn_si_incident?sysparm_query=opened_at>javascript:gs.daysAgo(30)
Identity: oauth app assurance-ro (table ACL: read)
Collector: servicenow-collector 2.0.3
Window: 720 h
Records: 1,975
SHA-256: a97ae05ac2af49d8f752970b0f25b8faa2eb33f9d29d89882ffc2ff8c4f9344e

ev-rs02-2

Automated containment covers 9 of 15 high-severity detection types

CrowdStrike Falcon · config · collected 3 h ago (Oct 15, 2026 · 12:02 UTC) · limit 30 days

Supports