Laserfiche WebLink
<br />©2025 Lumifi Cyber, Inc. All rights reserved. <br />PRIVATE - Controlled by Lumifi Cyber <br /> <br />5/19 <br />PRIVATE - Controlled by Lumifi Cyber <br />General Information <br />Background & Objectives <br />Purpose <br />Kittitas County would like for Lumifi Cyber to conduct an I ncident R esponse Tabletop <br />Exercises (TTE) against their Incident Response Plan (IRP). This statement of work <br />describes the approach and objectives for each session: <br />• To review and conduct a TTE or ‘dry run’ of the existing Kittitas County IRP <br />o Ensure Kittitas County staff understand the roles, responsibilities and <br />activities they will be required to perform when the IR Plan is activated <br />o Provide recommendations for subsequent TTEs that will include <br />scenarios designed to validate the remediation of weaknesses identified <br />in the first TTE <br />Scope <br />Our approach for the TTE program executes the following tasks: <br />• Review of current incident management and incident response practices, <br />processes and documentation against applicable standards of practice <br />• Document a formal incident response testing program for periodic evaluation <br />of the effectiveness and applicability of the program <br />o Develop testing criteria, requirements and procedures for the periodic <br />evaluation of the Incident Response Plan and its critical components <br />• Conduct the first TTE according to one of the following IR frameworks <br />o HITRUST CyberRX 2.0 Playbook Level 1 (Basic), a scenario -based <br />exercise program to assess the cyber security response preparedness <br />of healthcare organizations but is fully applicable to any organization <br />o We recommend the CyberRX approach as the NIST methodology is <br />not part of an integrated TTE approach <br />o A combination of the NIST 800 -62r2 Computer Security Incident <br />Handling Guide (NIST.SP.800-61r2), NIST 800-84 Guide to Test, Training, <br />and Exercise Programs for IT Plans and Capabilities (NIST.SP.800 -84) <br />and NIST 800 -184 Guide for Cybersecurity Event Recove ry (NIST.SP.800 - <br />184) <br />• Provide an after-action report that includes a Table of Findings and <br />Recommendations for increasing the effectiveness of the IR process and plans