IT 보안이란? - 정보 기술 보안 - Cisco
인터넷 보안에서는 브라우저에서 보내고 받는 정보를 보호하며, 웹 기반 애플리케이션의 네트워크 보안도 유지합니다. 이러한 보호 기능은 들어오는 인터넷 트래픽에서 ...
사고 대응 계획
해커의 수법이 갈수록 지능화됨에 따라 디지털 자산과 네트워크 장비 보호의 필요성도 계속 높아지고 있습니다. IT 보안을 유지하려면 비용이 많이 들기는 하지만, 조직에서 보안 침해가 발생하는 경우에는 훨씬 더 많은 비용이 발생합니다. 소규모 기업의 경우에는 대규모 보안 침해가 발생하면 기업의 존폐 자체가 위험해질 수도 있습니다. IT 보안 팀은 사고를 해결 중이거나 해결한 후에 <anchor>사고 대응 계획</anchor> 을 위험 관리 툴로 활용하여 상황을 통제할 수 있습니다.
What Is an Incident Response Plan for IT? - Cisco
What Is an Incident Response Plan for IT? - Cisco

- [Skip to content](#fw-content)
- Skip to search
- [Skip to footer](#fw-footer-v2)

- [Cisco.com Worldwide](/c/en/us/index.html)
- [Products and Services](/c/en/us/products/index.html)
- [Solutions](//www.cisco.com/c/en/us/solutions/index.html)
- [Support](/c/en/us/support/index.html)
- [Learn](/c/en/us/training-events.html)
- [Explore Cisco](//www.cisco.com/c/en/us/about/sitemap.html)
- [How to Buy](/c/en/us/buy.html)
- [Partners Home](/c/en/us/partners.html)
- [Partner Program](/c/en/us/partners/partner-with-cisco.html?ccid=cc000864&dtid=odiprc001129)
- [Support](/c/en/us/partners/support-help.html)
- [Tools](/c/en/us/partners/tools.html)
- [Find a Cisco Partner](//locatr.cloudapps.cisco.com/WWChannels/LOCATR/openBasicSearch.do)
- [Meet our Partners](/c/en/us/partners/connect-with-a-partner.html)
- [Become a Cisco Partner](//partnersuccess.cisco.com/becomeapartner)

- [Products & Services](/c/en/us/products/index.html)
- [Security](/c/en/us/products/security/index.html)

# What Is an Incident Response Plan for IT?

What does an incident response plan do?

An incident response plan is a set of instructions to help IT staff detect, respond to, and recover from network security incidents. These types of plans address issues like cybercrime, data loss, and service outages that threaten daily work.

- [Incident response (1:22)](javascript:void(0);)

- [Network security checklist](/c/en/us/solutions/small-business/resource-center/security/network-security-checklist.html)

### Contact Cisco

- [Get a call from Sales](https://www.cisco.com/site/us/en/about/contact-cisco/index.html?linkclickid=luh-contactus)

- ##### Call Sales:

- [1-800-553-6387](tel:18005536387)
- US/CAN \| 5am-5pm PT
- [Product / Technical Support](//www.cisco.com/c/en/us/support/index.html)

- [Training & Certification](https://www.cisco.com/c/en/us/training-events/training-certifications.html)


A sufficient incident response plan offers a course of action for all significant incidents. Some incidents lead to massive network or data breaches that can impact your organization for days or even months. When a significant disruption occurs, your organization needs a thorough, detailed incident response plan to help IT staff stop, contain, and control the incident quickly. For physical disruptors, such as natural disasters and flooding, create a [disaster recovery plan](/c/en/us/solutions/small-business/resource-center/secure-my-business/disaster-preparedness-steps.html).

### What is an incident recovery team?

An incident recovery team is the group of people assigned to implement the incident response plan. Generally, these are members of the IT staff who collect, preserve, and analyze incident-related data. Your IT staff may need to work with lawyers and communications experts to make sure that legal obligations are met.

### Why do you need an incident response plan?

If your network hasn’t been threatened yet, it will be. If it has, then you know the chaos that can follow a cyber attack. Whether a threat is virtual (security breaches) or physical (power outages or natural disasters), losing data or functionality can be crippling. An incident response plan and a disaster recovery plan help you mitigate risk and prepare for a range of events.

### How can you be sure your network is ready for a disaster?

Your network will never be 100 percent secure, so you must prepare both your network and your employees for crises to come. In addition to an incident response plan, you need a thorough disaster recovery plan that can mitigate the damage caused by a disaster.

### Are there tools that help automate an incident response plan?

[Cisco Umbrella Investigate](https://umbrella.cisco.com/products/threat-intelligence/) helps to automate many of the most common steps in an incident response. Investigate's rich threat intelligence adds the security context needed to uncover and predict threats.

Follow the five steps below to maintain business continuity.

## How to create an incident response plan

### 1\. Determine the critical components of your network

To protect your network and data against major damage, you need to replicate and store your data in a remote location. Because business networks are expansive and complex, you should determine your most crucial data and systems. Prioritize their backup, and note their locations. These actions will help you recover your network quickly.

### 2\. Identify single points of failure in your network and address them

Just as you should back up your data, you should have a plan B for every critical component of your network, including hardware, software, and staff roles. Single points of failure can expose your network when an incident strikes. Address them with redundancies or software failover features. Do the same with your staff. If a designated employee can’t respond to an incident, name a second person who can take over. By having backups and fail-safes in place, you can keep incident response and operations in progress while limiting damage and disruption to your network and your business."

### 3\. Create a workforce continuity plan

During a security breach or a natural disaster, some locations or processes may be inaccessible. In either case, the top priority is employee safety. Help ensure their safety and limit business downtime by enabling them to work remotely. Build out infrastructure with technologies such as virtual private networks (VPNs) and secure web gateways to support workforce communication.

### 4\. Create an incident response plan

Draw up a formal incident response plan, and make sure that everyone, at all levels in the company, understands their roles.

An incident response plan often includes:

- A list of roles and responsibilities for the incident response team members.
- A business continuity plan.
- A summary of the tools, technologies, and physical resources that must be in place.
- A list of critical network and data recovery processes.
- Communications, both internal and external.

### 5\. Train your staff on incident response

Only IT may need to fully understand the incident response plan. But it is crucial that everyone in your organization understands the importance of the plan. After you’ve created it, educate your staff about incident response. Full employee cooperation with IT can reduce the length of disruptions. In addition, understanding basic security concepts can limit the chances of a significant breach.

### Connect with us

- [All Cisco Secure Products](/site/us/en/products/security/index.html)
- [Secure Endpoint](/c/en/us/products/security/amp-for-endpoints/index.html)
- [Secure Firewall](/c/en/us/products/security/firewalls/index.html)
- [Cisco SecureX threat response](/c/en/us/products/security/threat-response.html)
- [Cisco Umbrella](https://umbrella.cisco.com/products/features/secret-sauce?utm_medium=web-referral&utm_source=cisco&utm_campaign=cs-fy2020-q2-cisco-100-day-sprint&utm_term=pgm)
- [Breach Defense](/c/en/us/solutions/security/breach-readiness-response/index.html)
- [Latest Cybersecurity Reports](/c/en/us/products/security/security-reports.html)

### Related network security topics

- [What Is Vulnerability Management?](/c/en/us/products/security/what-is-vulnerability-management.html)
- [What Is Network Security?](/c/en/us/products/security/what-is-network-security.html)
- [What Is a Cybersecurity Specialist?](/c/en/us/products/security/what-is-a-cybersecurity-specialist.html)
- [What Is Cyber Insurance?](/c/en/us/solutions/security/cyber-insurance/what-is-cyber-insurance.html)
- [What Is Threat Prevention?](/c/en/us/products/security/what-is-threat-prevention.html)
- [Network Security Checklist](/c/en/us/solutions/small-business/resource-center/secure-my-business/network-security-checklist.html)
- [What Is Machine Learning in Security?](/c/en/us/products/security/machine-learning-security.html)
- [What Is a Data Breach?](/c/en/us/products/security/what-is-data-breach.html)
- [What Is Disaster Recovery?](/c/en/us/products/security/what-is-disaster-recovery.html)

## Follow Cisco Secure

[Twitter](https://twitter.com/ciscosecure)

[Facebook](https://www.facebook.com/ciscosecure/)

[Instagram](https://www.instagram.com/ciscosecure/)

[LinkedIn](https://www.linkedin.com/showcase/cisco-secure/)

[YouTube](https://www.youtube.com/user/cisco)

[Blogs](https://blogs.cisco.com/security)

[Communities](https://community.cisco.com/t5/security/ct-p/4561-security)

- [Trials](/c/en/us/products/security/promotions-free-trials.html)
- [Demos](https://www.cisco.com/site/us/en/products/trials-demos.html?filters=%2Fmarketing-portfolio%2Fproducts%2Fsecurity)
- [Webinars](/c/en/us/products/security/webinars-and-demos.html)