↑↓ to move, Enter to open, Esc to close. Try 3.5.3, AC.L2-3.1.1, MFA or unmarked.
Establish operational incident handling capability.
Incident response asks for a capability, not a document: you can detect, contain, recover and report, you test that capability, and you track incidents through to closure. DFARS 252.204-7012 adds its own 72-hour reporting duty on top.
