Assessor Resource

ICTSAS501
Develop, implement and evaluate an incident response plan

Assessment tool

Version 1.0
Issue Date: May 2024


This unit describes the skills and knowledge required to develop and implement an incident response plan. The results of the incident response plan must be evaluated if they affect the mission of the organisation.

It applies to individuals who apply high-level technical skills and specialised knowledge to provide broad support functions in maintaining network service.

No licensing, legislative or certification requirements apply to this unit at the time of publication.

You may want to include more information here about the target group and the purpose of the assessments (eg formative, summative, recognition)


Evidence Required

List the assessment methods to be used and the context and resources required for assessment. Copy and paste the relevant sections from the evidence guide below and then re-write these in plain English.

ELEMENT

PERFORMANCE CRITERIA

Elements describe the essential outcomes.

Performance criteria describe the performance needed to demonstrate achievement of the element.

1. Develop the incident response program

1.1 Develop the incident management policy

1.2 Identify services the incident response team should provide

1.3 Create incident response plans according to security policy and organisational goals

1.4 Develop procedures for incident handling and reporting

1.5 Create incident response exercises and red-teaming activities

1.6 Develop specific processes for collecting and protecting forensic evidence during incident response

1.7 Specify incident response staffing and training requirements

1.8 Establish the response program

2. Implement the incident response program

2.1 Apply response actions in reaction to security incidents according to established policy, plans and procedures

2.2 Respond to and report incidents

2.3 Assist in collecting, processing and preserving evidence according to requirements

2.4 Execute incident response plans

2.5 Execute red-teaming activities and incident response exercises

2.6 Ensure lessons learned from incidents are collected in a timely manner and are incorporated into review plans

2.7 Collect, analyse and report incident management measures

3. Evaluate the incident response program

3.1 Assess efficiency and effectiveness of incident response program activities and implement changes as required

3.2 Examine effectiveness of red teaming and incident response tests, training and exercises

3.3 Assess effectiveness of communication between incident response team and related internal and external organisations, implementing changes where appropriate

3.4 Identify and implement improvements based on assessments of effectiveness

Evidence of the ability to:

develop and document an incident response program

respond to an incident response activation and operation

evaluate the incident response.

Note: Evidence must be provided on at least TWO occasions.

To complete the unit requirements safely and effectively, the individual must:

explain the key features of:

client business domain

relevant workplace procedures and legislative requirements when formulating prevention and recovery strategy

systems engineering when evaluating threats

analyse and describe:

backup methodologies

specific components of the business planning process relevant to the development of information and communications technology (ICT) business solutions

system functionality of a current business.

Gather evidence to demonstrate consistent performance in conditions that are safe and replicate the workplace. Noise levels, production flow, interruptions and time variances must be typical of those experienced in the systems administration and support field of work and include access to:

ICT business specifications

information on the security environment, including relevant laws and legislation

existing organisational security policies, organisational expertise and knowledge

possible security environment, including threats to security that are, or are held to be, present in the environment

risk analysis tools and methodologies

ICT security assurance specifications

incident scenarios.

Assessors must satisfy NVR/AQTF assessor requirements.

Submission Requirements

List each assessment task's title, type (eg project, observation/demonstration, essay, assingnment, checklist) and due date here

Assessment task 1: [title]      Due date:

(add new lines for each of the assessment tasks)

Assessment Tasks

Copy and paste from the following data to produce each assessment task. Write these in plain English and spell out how, when and where the task is to be carried out, under what conditions, and what resources are needed. Include guidelines about how well the candidate has to perform a task for it to be judged satisfactory.

ELEMENT

PERFORMANCE CRITERIA

Elements describe the essential outcomes.

Performance criteria describe the performance needed to demonstrate achievement of the element.

1. Develop the incident response program

1.1 Develop the incident management policy

1.2 Identify services the incident response team should provide

1.3 Create incident response plans according to security policy and organisational goals

1.4 Develop procedures for incident handling and reporting

1.5 Create incident response exercises and red-teaming activities

1.6 Develop specific processes for collecting and protecting forensic evidence during incident response

1.7 Specify incident response staffing and training requirements

1.8 Establish the response program

2. Implement the incident response program

2.1 Apply response actions in reaction to security incidents according to established policy, plans and procedures

2.2 Respond to and report incidents

2.3 Assist in collecting, processing and preserving evidence according to requirements

2.4 Execute incident response plans

2.5 Execute red-teaming activities and incident response exercises

2.6 Ensure lessons learned from incidents are collected in a timely manner and are incorporated into review plans

2.7 Collect, analyse and report incident management measures

3. Evaluate the incident response program

3.1 Assess efficiency and effectiveness of incident response program activities and implement changes as required

3.2 Examine effectiveness of red teaming and incident response tests, training and exercises

3.3 Assess effectiveness of communication between incident response team and related internal and external organisations, implementing changes where appropriate

3.4 Identify and implement improvements based on assessments of effectiveness

Evidence of the ability to:

develop and document an incident response program

respond to an incident response activation and operation

evaluate the incident response.

Note: Evidence must be provided on at least TWO occasions.

To complete the unit requirements safely and effectively, the individual must:

explain the key features of:

client business domain

relevant workplace procedures and legislative requirements when formulating prevention and recovery strategy

systems engineering when evaluating threats

analyse and describe:

backup methodologies

specific components of the business planning process relevant to the development of information and communications technology (ICT) business solutions

system functionality of a current business.

Gather evidence to demonstrate consistent performance in conditions that are safe and replicate the workplace. Noise levels, production flow, interruptions and time variances must be typical of those experienced in the systems administration and support field of work and include access to:

ICT business specifications

information on the security environment, including relevant laws and legislation

existing organisational security policies, organisational expertise and knowledge

possible security environment, including threats to security that are, or are held to be, present in the environment

risk analysis tools and methodologies

ICT security assurance specifications

incident scenarios.

Assessors must satisfy NVR/AQTF assessor requirements.
Copy and paste from the following performance criteria to create an observation checklist for each task. When you have finished writing your assessment tool every one of these must have been addressed, preferably several times in a variety of contexts. To ensure this occurs download the assessment matrix for the unit; enter each assessment task as a column header and place check marks against each performance criteria that task addresses.

Observation Checklist

Tasks to be observed according to workplace/college/TAFE policy and procedures, relevant legislation and Codes of Practice Yes No Comments/feedback
Develop the incident management policy 
Identify services the incident response team should provide 
Create incident response plans according to security policy and organisational goals 
Develop procedures for incident handling and reporting 
Create incident response exercises and red-teaming activities 
Develop specific processes for collecting and protecting forensic evidence during incident response 
Specify incident response staffing and training requirements 
Establish the response program 
Apply response actions in reaction to security incidents according to established policy, plans and procedures 
Respond to and report incidents 
Assist in collecting, processing and preserving evidence according to requirements 
Execute incident response plans 
Execute red-teaming activities and incident response exercises 
Ensure lessons learned from incidents are collected in a timely manner and are incorporated into review plans 
Collect, analyse and report incident management measures 
Assess efficiency and effectiveness of incident response program activities and implement changes as required 
Examine effectiveness of red teaming and incident response tests, training and exercises 
Assess effectiveness of communication between incident response team and related internal and external organisations, implementing changes where appropriate 
Identify and implement improvements based on assessments of effectiveness 

Forms

Assessment Cover Sheet

ICTSAS501 - Develop, implement and evaluate an incident response plan
Assessment task 1: [title]

Student name:

Student ID:

I declare that the assessment tasks submitted for this unit are my own work.

Student signature:

Result: Competent Not yet competent

Feedback to student

 

 

 

 

 

 

 

 

Assessor name:

Signature:

Date:

Assessment Record Sheet

ICTSAS501 - Develop, implement and evaluate an incident response plan

Student name:

Student ID:

Assessment task 1: [title] Result: Competent Not yet competent

(add lines for each task)

Feedback to student:

 

 

 

 

 

 

 

 

Overall assessment result: Competent Not yet competent

Assessor name:

Signature:

Date:

Student signature:

Date: