RS.AN-2: Incident Impact Analysis
When a security incident strikes, understanding its full impact determines your response effectiveness and business recovery time. RS.AN-2 requires your team to systematically analyze incident scope, severity, and consequences across systems and operations. This control transforms reactive firefighting into informed decision-making that protects both your infrastructure and stakeholders.
What this means
Incident impact analysis means establishing processes to comprehensively understand what happened during a security event and what it means for your organization. This includes identifying affected systems and data, determining the scope of compromise, assessing business disruption, and quantifying potential harm to operations, customer trust, and regulatory standing. The goal is creating a clear picture of incident consequences in real time, not weeks after containment.
How to comply
- 1.Define incident impact assessment criteria covering technical scope (systems affected, data exposed), business impact (revenue loss, service downtime), and stakeholder impact (customer notification requirements, regulatory reporting).
- 2.Create a standardized incident impact analysis template documenting initial assessment findings, evidence collection methods, and severity classification.
- 3.Train your incident response team on impact assessment techniques, including how to interview system owners, review logs, and estimate affected user counts.
- 4.Establish severity ratings (critical, high, medium, low) tied to business consequences, not just technical metrics.
- 5.Document impact findings in your incident tracking system with timeline updates as analysis progresses.
- 6.Conduct post-incident reviews to validate impact assessments against actual business effects and refine your assessment process.
Evidence auditors look for
- Incident response playbook with dedicated impact analysis section and assessment procedures
- Completed incident impact assessment reports for past events showing affected systems, data scope, and business consequences
- Incident severity classification matrix tied to business impact categories
- Training materials and sign-off records showing staff competency in impact analysis
- Incident tracking tool screenshots demonstrating impact documentation and severity assignment
- Post-incident review minutes discussing impact assessment accuracy and process improvements
Frequently asked questions
When will FAQs be available?
The FAQ for this control is currently being prepared.
GRCWatch automates incident impact categorization by integrating with your existing tools to classify severity, track affected assets, and pre-populate stakeholder notification templates—cutting incident analysis time from hours to minutes.
See how GRCWatch handles this control automatically
Start free trial