Reference no: EM132674305

IT (Information Technology)

Study Case

All login and logout activity are recorded and retained. All event activity is sent to ABC's log server and analyzed by the SIEM. For any unusual activity, based on customized policies, an incident is recorded to ABC's IT Incident Response System (ICS). ICS will then send emails and text messages alerting Security administration staff who monitors 24 by 7. Notifications are continuously sent and escalation to the CIO will occur if the response is not timely. The incident responder must accept the incident within ICS or notifications will continue. All follow-up by Security Administration is recorded in ICS. Incident tickets remain open until resolved.

Question or what needs to be solved: What are the Controls and what are the GAPS in the study case