Control calendar
Cadence comes from policy — it is what an auditor measures. How often a collector samples is a separate thing, shown on the Collectors page.
| Control | Status | Cadence | Last | Next due | TSC | Description |
|---|---|---|---|---|---|---|
| IS-07:IR-05 | No evidence | Semi-annual | — | — | CC7.5 | Tabletop exercise with scenario, participants, findings, remediation docu… manual |
| IS-07:IR-06 | No evidence | Annual | — | — | CC7.5 | Full-scale IR test or formal tabletop conducted and documented annually manual |
| IS-07:IR-07 | No evidence | Annual | — | — | CC7.3 | All employees receive IR awareness training; IRT specialised training ann… |
| IS-07:IR-01 | Event-driven | Continuous | — | — | CC7.3 | Security monitoring continuous; incidents triaged and classified within 3… |
| IS-07:IR-02 | Event-driven | Event-driven | — | — | CC7.3 | All incidents logged in Jira with type, severity, actions, resolution |
| IS-07:IR-03 | Event-driven | Event-driven | — | — | CC7.4 | P1/P2 incidents escalated to executives; regulatory notification in requi… manual |
| IS-07:IR-04 | Event-driven | Event-driven | — | — | CC7.5 | Post-incident review conducted; lessons learned documented manual |
| IS-07:IR-08 | Event-driven | Event-driven | — | — | CC7.4 | Vendor incident response requirements in contracts; notification within 1… manual |
8 controls shown.