FR 6 — Timely Response to Events (TRE)

Detect cybersecurity events and respond quickly to limit impact, including alerting, analysis, and containment.

• Event correlation across identity, device, and network signals
• Risk scoring and prioritization for OT-safe response
• Playbooks for quarantine, step-up verification, and escalation
• Immutable incident timelines for post-incident review

• Scope by zone: identify where this FR is most critical (e.g., safety zone, engineering access, remote vendor conduit).
• Start in observe mode: baseline behavior and identify necessary exceptions.
• Enforce gradually: enable controls in phases aligned to maintenance windows; document exceptions.
• Continuously verify: monitor drift and anomalies; automate response where safe.

• Alert evidence with severity and rationale
• Response actions taken (who/when/what)
• Incident timelines and lessons learned artifacts