Annex 3.6.3

Annex 3.6.3 requires planned-interval review of whether incidents triggered post-incident reviews; a ransomware event would be expected to populate that schedule.

Planned-interval review under Annex 3.6.3 must include wiper events in the population whose post-incident-review status is tracked.

Planned-interval review tracks whether deception events are captured by the post-incident-review process.

Planned-interval Annex 3.6.3 review tracks whether disruption events are captured by post-incident-review discipline.

Annex 3.6.3 planned-interval review of post-incident-review status applies to denial events.

Annex 3.6.3 planned-interval tracking ensures destruction events do not slip the post-incident-review schedule.

Annex 3.6.3 planned-interval tracking applies to infrastructure-compromise events.