Unit of competency Outline
Date retreived
22/07/2026 4:43 PM AWST
22/07/2026 4:43 PM AWST
Whilst all efforts are made to provide accurate and timely information from the relevant source/documentation, please be aware that the information supplied may not be the most current version. The accuracy of the detail has not been confirmed by the Department and therefore should not be relied upon without first confirming the contents.
Develop, implement and evaluate an incident response plan
Develop, implement and evaluate an incident response plan
Unit of competency
National Code
ICASAS501A
ICASAS501A
State Code
D8088
D8088
TGA Status
Replaced
Replaced
DTWD Status
Replaced
Replaced
State Implementation and Classification
Approved Date
04/11/2011
Field of Education
020113 - Networks And Communications
Original Release Date
04/11/2011
Nominal Hours
25
Description
This unit describes the performance outcomes, skills and knowledge required to develop and implement an incident response plan. The results of the incident response plan must be evaluated if they affect the mission of the organisation.
Notes
Elements and Performance Criteria
1. Develop the incident response program
- 1.1 Develop the incident management policy
- 1.2 Identify the services the incident response team should provide
- 1.3 Create incident response plans according to security policy and organisational goals
- 1.4 Develop procedures for incident handling and reporting
- 1.5 Create incident response exercises and red-teaming activities
- 1.6 Develop specific processes for collecting and protecting forensic evidence during incident response
- 1.7 Specify incident response staffing and training requirements
- 1.8 Establish the response program
2. Implement the incident response program
- 2.1 Apply response actions in reaction to security incidents according to established policy, plans and procedures
- 2.2 Respond to and report incidents
- 2.3 Assist in collecting, processing and preserving evidence according to requirements
- 2.4 Execute incident response plans
- 2.5 Execute red-teaming activities and incident response exercises
- 2.6 Ensure lessons learned from incidents are collected in a timely manner and are incorporated into review plans
- 2.7 Collect, analyse and report incident management measures
3. Evaluate the incident response program
- 3.1 Assess efficiency and effectiveness of incident response program activities and implement changes as required
- 3.2 Examine effectiveness of red teaming and incident response tests, training and exercises
- 3.3 Assess effectiveness of communication between incident response team and related internal and external organisations, implementing changes where appropriate
- 3.4 Identify and implement improvements based on assessments of effectiveness
The range statement relates to the unit of competency as a whole. It allows for different work environments and situations that may affect performance. Bold italicised wording, if used in the performance criteria, is detailed below. Essential operating conditions that may be present with training and assessment (depending on the work situation, needs of the candidate, accessibility of the item, and local industry and regional contexts) may also be included.
Incident may include:
fire
misuse or improper access
other physical damage
theft of data or property
unauthorised publication.
According to requirements may include:
directives
laws
policies
procedures
regulations
standards.
Incident may include:
fire
misuse or improper access
other physical damage
theft of data or property
unauthorised publication.
According to requirements may include:
directives
laws
policies
procedures
regulations
standards.
The evidence guide provides advice on assessment and must be read in conjunction with the performance criteria, required skills and knowledge, range statement and the Assessment Guidelines for the Training Package.
Overview of assessment
Critical aspects for assessment and evidence required to demonstrate competency in this unit
Evidence of the ability to:
develop an incident response program
manage an incident response activation and operation
evaluate the incident response.
Context of and specific resources for assessment
Assessment must ensure access to:
appropriate learning and assessment support when required
modified equipment for people with special needs
IT business specifications
information on the security environment, including relevant laws and legislation, existing organisational security policies, organisational expertise and knowledge
possible security environment, including threats to security that are, or are held to be, present in the environment
risk analysis tools and methodologies
IT security assurance specifications
incident scenarios.
Method of assessment
A range of assessment methods should be used to assess practical skills and knowledge. The following examples are appropriate for this unit:
verbal or written questioning to assess candidate’s knowledge of security environment and risk analysis
review of incident response plan and associated documentation.
Guidance information for assessment
Holistic assessment with other units relevant to the industry sector, workplace and job role is recommended, where appropriate.
Assessment processes and techniques must be culturally appropriate, and suitable to the communication skill level, language, literacy and numeracy capacity of the candidate and the work being performed.
Indigenous people and other people from a non-English speaking background may need additional support.
In cases where practical assessment is used it should be combined with targeted questioning to assess required knowledge.
Overview of assessment
Critical aspects for assessment and evidence required to demonstrate competency in this unit
Evidence of the ability to:
develop an incident response program
manage an incident response activation and operation
evaluate the incident response.
Context of and specific resources for assessment
Assessment must ensure access to:
appropriate learning and assessment support when required
modified equipment for people with special needs
IT business specifications
information on the security environment, including relevant laws and legislation, existing organisational security policies, organisational expertise and knowledge
possible security environment, including threats to security that are, or are held to be, present in the environment
risk analysis tools and methodologies
IT security assurance specifications
incident scenarios.
Method of assessment
A range of assessment methods should be used to assess practical skills and knowledge. The following examples are appropriate for this unit:
verbal or written questioning to assess candidate’s knowledge of security environment and risk analysis
review of incident response plan and associated documentation.
Guidance information for assessment
Holistic assessment with other units relevant to the industry sector, workplace and job role is recommended, where appropriate.
Assessment processes and techniques must be culturally appropriate, and suitable to the communication skill level, language, literacy and numeracy capacity of the candidate and the work being performed.
Indigenous people and other people from a non-English speaking background may need additional support.
In cases where practical assessment is used it should be combined with targeted questioning to assess required knowledge.
Replaces
| State Code | National Code | Title | Type |
|---|---|---|---|
| D2818 | ICAI5252A | Develop, implement and evaluate an incident response plan | Unit of competency |
Replaced By
| State Code | National Code | Title | Type |
|---|---|---|---|
| AUW66 | ICTSAS501 | Develop, implement and evaluate an incident response plan | Unit of competency |
| State Code | National Code | Title | Type |
|---|---|---|---|
| D567 | ICA50111 | Diploma of Information Technology | Qualification |
| D570 | ICA50411 | Diploma of Information Technology Networking | Qualification |