(n) incident response.
(a) As part of its cybersecurity program, each Covered Entity shall establish a written incident response plan designed to promptly respond to, and recover from, any Cybersecurity Event materially affecting the confidentiality, integrity or availability of the Covered Entity’s Information Systems or the continuing functionality of any aspect of the Covered Entity’s business or operations.
(b) Such incident response plan shall address the following areas:
(2) the goals of the incident response plan;
(6) documentation and reporting regarding Cybersecurity Events and related incident response activities; and
(7) the evaluation and revision as necessary of the incident response plan following a Cybersecurity Event.
