What should an organisation define when developing the detection strategy for information security incidents?

The organisation should define the conditions that trigger a process that would require personnel intervention and further analysis for those items within the scope of event detection.

What elements can be used to define the conditions for event detection in the detection strategy?

The conditions may be defined using elements from the expected functional baseline and the expected information security baseline.

What does the expected information security baseline help to identify?

The expected information security baseline helps to identify deviations from the expected information security operation of information security controls.

What should the conditions for event detection consider?

The conditions should consider both abnormal behaviour and substantial deviations from the baselines, as well as relevant correlation of multiple independent events.

In the context of the detection strategy, what is excluded from the expected functional baseline?

Information security functions/controls are excluded from the expected functional baseline.

What is the purpose of defining conditions that trigger a process in the detection strategy?

The purpose is to require personnel intervention and further analysis for items within the scope of event detection.

How should the conditions for event detection address multiple independent events?

The conditions should consider relevant correlation of multiple independent events.

GM1 IS.I.OR.220(a) Information security incidents -- detection, response and recovery

Q: What does the expected functional baseline help to identify?

The expected functional baseline helps to identify deviations from the expected functional operation of the system, excluding information security functions/controls.

Q: Where can further guidance on the objectives for the establishment of a detection strategy be found?

Further guidance can be found in EUROCAE ED-206, Chapter 4.

Navigate / EASA

Ask question Discover more Add to collection

GM1 IS.I.OR.220(a) Information security incidents — detection, response and recovery

ED Decision 2023/009/R

DETECTION STRATEGY

When developing the detection strategy, for those items within the scope of event detection, the organisation should define the conditions that trigger a process that, for example, would require personnel intervention and further analysis. These conditions on the items may be defined using elements from the:

(a) expected functional baseline: engage in the identification of deviations from the expected functional operation of the system (excluding information security functions/controls);

(b) expected information security baseline: engage in the identification of deviations from the expected information security operation of information security controls.

These conditions should consider both abnormal behaviour and substantial deviations from the baselines and relevant correlation of multiple independent events.

Further guidance on the objectives for the establishment of a detection strategy can be found in EUROCAE ED-206, Chapter 4.

Details

Source-Title: GM1 IS.I.OR.220(a) Information security incidents -- detection, response and recovery View latest amendments

Erulesid: ERULES-1963177438-21759 Compare versions

Domain: Information Security (IS)

Amendedby: Issue 1

Applicabilitydate: 22 February, 2026

Entryintoforcedate: 14 July, 2023

Regulatorysource: ED Decision 2023/009/R Navigate

Regulatorysubject: Part-IS.I.OR

Typeofcontent: GM to IR (Guidance material to implementing rule)

Parentir: IS.I.OR.220 Information security incidents -- detection, response and recovery

Origin: EASA

Category: EAR