Objective 5.1: Increase voluntary incident reporting and victim notification to facilitate the
provision of response assistance.
DHS cybersecurity efforts must be directed to build trusted relationships with entities at greatest
risk of experiencing potentially significant cyber incidents. These relationships, especially
through DHS field offices and sector specific agencies, help to facilitate the provision of DHS
and other federal resources following an incident. DHS must encourage the reporting of
incidents, and work with other incident responders to develop consistent processes for notifying
potential victims of cyber incidents. Encouraging a culture of reporting, notification, and
information sharing will increase the security and resilience of critical infrastructure, help
prevent, counter, and disrupt illicit cyber actors, and enable the government to assess and
potentially manage responses to incidents of unknown severity.
Sub-Objectives:
a. Encourage reporting of cyber incidents by nonfederal entities to DHS or other law
enforcement agencies, relevant sector specific agencies, and the National Cybersecurity
and Communications Integration Center (NCCIC).
b. Improve processes to facilitate timely and effective notification to potential victims of
cyber incidents by DHS and other agencies, and to enhance sector specific agency
awareness of incidents within their sectors.
Outcomes:
DHS receives reports of cyber incidents and, in appropriate coordination with other agencies,
makes timely victim notifications.
Objective 5.2: Expand asset response capabilities to mitigate and manage cyber incidents.
DHS provides asset response assistance to requesting entities following incidents that pose
significant risks to national security, public health and safety, or economic security, or as
otherwise appropriate to the circumstances. DHS is also responsible for maintaining shared
situational awareness of emerging cybersecurity risks and incidents. During significant cyber
incidents, DHS serves as the lead agency for asset response, as part of a Cyber Unified
Coordination Group, and supports the White House-led Cyber Response Group. DHS must
continue to build capabilities to provide technical assistance and mitigation recommendations,
including on-site incident response teams, following cyber incidents. DHS must also leverage
incident information to identify emerging risks and protect entities that rely on impacted entities
or those at risk of similar incidents.
Sub-Objectives:
a. Develop technical asset response capabilities to respond to cyber incidents.
b. Establish a common operating picture across the Department and with other stakeholders
to assess emerging incidents and associated national, regional, or sector risks.
c. Build capacity to manage national asset response efforts and support a Cyber Unified
Coordination Group and Cyber Response Group following significant incidents.
20
Select target paragraph3
Connect to a paragraph
Connect to an entity
Disable highlights
Add to table of contents