[5.1.1] Log and Sensor Management - Connecting, configuring, maintaining, and monitoring information system log sources and security sensor data sources to ensure the timely collection of security event data.

[5.1.2] Detection use case management - Developing, testing, updating, and evaluating the effectiveness of security event detection rules, scenarios, and correlation logic.

[5.1.3] Contextual data management - Collecting and integrating additional information about users, systems, networks, vulnerabilities, and threats to improve detection accuracy.

[5.2.1] Correlation - Linking security events from different sources based on common characteristics, timing, and context to identify potential attack patterns or related events.

[5.2.2] 1.2.2 Event Assessment - Analyzing detected security events to determine their significance, reliability, potential threat, and whether response actions need to be initiated.

[6.1.1] Receipt of Cybersecurity Incident Reports - Receiving reports of suspected or confirmed cybersecurity incidents through designated communication channels and collecting initial information via National Cybersecurity Incident Management Platform, email at [email protected]

[6.1.2] Cybersecurity incident triage and processing- Assessing the reliability of the information received, the indicators of an incident, and its potential impact to determine whether further action is required.

[6.2.1] Cybersecurity Incident Categorization and Prioritization (Triage) - Assigning an incident to the appropriate category and establishing its response priority based on the nature of the threat, impact, and urgency.

[6.2.2] Cybersecurity Incident Information Collection - Collecting technical data, log records, system status information, and other evidence to establish the circumstances of the incident.

[6.2.3] Coordination of Detailed Analysis - Organizing an in-depth incident investigation, assigning tasks to specialists, and ensuring that investigative activities are coordinated.

[6.2.4] Identification of the Root Cause of a Cybersecurity Incident - Identifying the technical, procedural, or organizational factors that caused the incident to prevent recurrence.

[6.2.5] Cross-incident correlation - Analyzing similarities and links between multiple incidents in terms of indicators, infrastructure, methods, and timing to identify a common origin or coordinated malicious activity.

[6.3.1] Analysis of the Public Information Space and External Attack Surface - Analyzing publicly available information, internet resources, domains, IP addresses, and other external resources to identify threats and potential indicators of compromise.

[6.3.2] Reverse Engineering - Analyzing source code or executable files to determine their operating principles, functions, malicious logic, and potential mechanisms of compromise.

[6.3.3] Dynamic Analysis (Runtime Analysis) - Monitoring the behavior of applications, files, or processes in a controlled environment to identify their behavior and potential malicious activity.

[6.3.4] Comparative Analysis - Comparing collected artifacts, system states, or activity indicators against known baselines, historical data, or indicators from other incidents to identify anomalies and relationships.

[6.4.1] Response plan establishment - Preparing a plan for incident containment, impact mitigation, eradication, and system recovery, including the assignment of responsibilities and priorities.

[6.4.2] Application of Ad Hoc Measures - Implementing urgent technical and organizational measures to limit incident propagation, reduce damage, and stop malicious activity.

[6.4.3] System Restoration - Restoring affected systems, services, and data to a secure, reliable, and operational state, while verifying that the causes of the incident have been eliminated.

[6.4.4] Assistance to Other Cybersecurity Entities - Providing methodological, technical, and analytical assistance to other entities experiencing cybersecurity incidents or carrying out incident management activities.

[6.5.1] Communication - Sharing incident-related information with stakeholders to ensure timely and coordinated information exchange.

[6.5.2] Alert Dissemination - Delivering urgent alerts concerning identified threats, incidents, or necessary protective measures to relevant recipients.

[6.5.3] Dissemination of Relevant Information - Sharing incident-related technical indicators, threat intelligence, and recommendations with operationally involved or affected parties.

[6.5.4] Activities Coordination - Track the status of all communication and activities.

[6.5.5] Reporting - Preparing and submitting structured reports on incident progress, impact, actions taken, and results.

[6.5.6] External Communication - Preparing and providing official incident-related information to external authorities, partners, the public, or the media in accordance with assigned responsibilities and communication rules.

[6.6.1] Information Dissemination to Cybersecurity Entities - Communicating relevant information about the progress of a cyber crisis, threats, and recommended actions to affected and interested entities.

[6.6.2] Cybersecurity Status Reports - Preparing reports on the overall cybersecurity situation, incident scale, impact, and response capabilities for decision-makers.

[6.6.3] Communication of Strategic Decisions - Communicating strategic decisions, priorities, and instructions related to crisis management to responsible authorities and operational personnel.

Additional activity: Consultation on the development and coordination of cyber crisis management capabilities.

[7.1.1] Incident response vulnerability discovery - Identify a vulnerability that was exploited as part of a security incident.

[7.1.2] Public source vulnerability discovery - Monitoring public vulnerability databases, security advisories, and technical publications to identify relevant threats to technologies in use.

[7.1.3] Vulnerability Research - Analyzing systems, software, or technologies to identify, verify, and technically characterize potential security weaknesses.

[7.2.1] Receipt of Vulnerability Reports - Receiving reports of potential security weaknesses from researchers, users, vendors, and other sources.

[7.2.2] Vulnerability report triage and processing - AInitially review, categorize, prioritize, and process a vulnerability report.

[7.3.1] Vulnerability Verification - Conducting controlled technical testing to verify whether a reported security weakness exists and under what conditions it could be exploited.

[7.3.2] Root Cause Analysis - Identifying the technical and procedural factors that led to the vulnerability.

[7.3.3] Vulnerability Mitigation Plan Development - Selecting measures to eliminate a vulnerability, reduce the likelihood of exploitation, or limit its impact, and planning their implementation.

[7.4.1] Vulnerability Notification and Reporting - Submitting information about a vulnerability in a prescribed format to responsible organizations, vendors, or other competent parties.

[7.4.2] Vulnerability stakeholder coordination - Organizing cooperation among vulnerability discoverers, vendors, service providers, and other stakeholders to coordinate remediation and notification activities.

[7.5.1] Maintenance of Vulnerability Disclosure Policies and Infrastructure - Establishing and maintaining responsible vulnerability disclosure rules, reporting channels, and handling processes.

[7.5.2] Vulnerability Notification, Communication, and Dissemination - Preparing and distributing coordinated information about a vulnerability, its impact, remediation measures, and protective recommendations.

[7.5.3] Post-vulnerability disclosure feedback - Providing reporters and other stakeholders with updates on the handling of a report, decisions made, and results achieved.

[7.6.1] Vulnerability Detection and Scanning - Examining systems, networks, and software using automated or manual methods to identify known security weaknesses.

[7.6.2] Vulnerability Remediation - Remediate or mitigate vulnerabilities to prevent them from being exploited, typically through the timely application of vendor-provided patches or other solutions.

[8.1.1] Policy Aggregation, Distillation, and Guidance - Analyzing relevant strategies, policy documents, and requirements to identify key directions, priorities, and practical recommendations.

[8.1.2] Asset mapping to functions, roles, actions, and key risks - Linking information about organizations, infrastructure, responsibilities, and risks to assess their interdependencies.

[8.1.3] Collection - Gathering information about cyber threats, incidents, vulnerabilities, and security posture from internal and external sources.

[8.1.4] Data Processing - Validating, normalizing, classifying, and structuring collected data so that it can be used for analysis and decision-making.

[8.2.1] Forecasting - Analyzing existing data, trends, and threats to anticipate potential cybersecurity developments and future risks.

[8.2.2] Event Detection - Analyzing collected information to identify significant cyber events, anomalies, and emerging threats in a timely manner.

[8.2.3] Decision-Making Support for Cybersecurity Incident Management - Providing incident managers with analytical information, impact assessments, and alternative courses of action.

[8.2.4] Situational impact - Analyzing the overall cybersecurity situation, affected systems, services, organizations, and related dependencies.

[8.3.1] Internal and External Communication - Coordinating information exchange within and outside the organization to ensure clear, timely, and consistent communication with employees, partners, and other stakeholders.

[8.3.2] Reporting and Recommendations - Summarizing operational results, identified problems, and relevant findings, and preparing reports and recommendations to support informed decision-making.

[8.3.3] Implementation - Coordinating the implementation of agreed actions and recommendations, monitoring progress, and cooperating with responsible parties to achieve intended results.

[8.3.4] Dissemination, Integration, and Information Sharing - Distributing relevant information, integrating it into existing systems or processes, and sharing it with appropriate parties to ensure accessibility and practical use.

[8.3.5] Information-Sharing Management - Establishing and maintaining information-sharing processes, channels, and access arrangements to ensure secure, controlled, and efficient information exchange.

[8.3.6] Feedback - Collecting and evaluating feedback and comments from stakeholders and using them to improve communication, cooperation, and the quality of activities.

[9.1.1] Research and Information Aggregation - Collecting and consolidating relevant research, threat data, security recommendations, and information from other sources.

[9.1.2] Reports and awareness materials development - Preparing informational notices, security bulletins, reports, and educational materials for different target groups.

[9.1.3] Information Dissemination - Distributing prepared information about threats, security practices, and protective measures through selected communication channels.

[9.1.4] Relationship Management and Engagement - Maintaining cooperation with the cybersecurity community, Cyber Security Entities, organizations, and other stakeholders and engaging them in joint activities.

[9.2.1] Identification of Knowledge, Skills, and Competene Needs - Assessing the competencies and learning needs of target groups to identify required training topics and priorities.

[9.2.2] Development of Educational and Training Materials - Preparing training programs, methodological materials, practical exercises, and other educational resources.

[9.2.3] Delivery of Training Content - Conducting training sessions, seminars, lectures, and other educational activities and delivering learning materials to target groups.

[9.2.4] Professional Development of CSIRT Staff - Strengthening the technical, analytical, and organizational competencies of cybersecurity incident response team personnel.

[9.3.1] Requirements Analysis - Defining exercise objectives, participants, competencies to be assessed, requirements, and expected outcomes.

[9.3.2] Preparation of the Format and Environment - Preparing an appropriate exercise format, technical infrastructure, tools, and working environment for participants.

[9.3.3] Scenario Development - Developing a realistic cybersecurity incident or crisis scenario, including tasks and evolving situational developments.

[9.3.4] Exercise Execution - Organizing planned activities, observing participants' actions, and assessing their ability to respond to cyber threats.

[9.3.5] Exercise outcome review - Analyzing exercise outcomes, discussing identified deficiencies, and preparing recommendations for improvement.

[9.4.1] Risk Management Consultations - Providing advice on identifying, assessing, prioritizing, and mitigating cybersecurity risks.

[9.4.2] Business Continuity and Disaster Recovery Planning and Support - Assisting with the development and improvement of business continuity, system recovery, and service restoration plans.

[9.4.3] Policy Development Advice - Providing consultations on the development, assessment, and improvement of cybersecurity policies, rules, and procedures.

[9.4.4] Technical Consultations - Providing technical recommendations on system protection, secure configuration, incident prevention, and other cybersecurity matters.

Preparation of preliminary lists of essential and important cybersecurity entities based on general criteria

Preparation of preliminary lists of essential and important cybersecurity entities based on specific criteria

Registration and deregistration of essential and important cybersecurity entities in the Cybersecurity Information System

Monitoring the implementation of cybersecurity risk management measures - Assessing implementation progress and effectiveness to identify the need for improvement.

Cybersecurity posture assessment (completion of self-assessment questionnaires)

Scheduled and unscheduled compliance inspections - Examining entities' activities, documentation, and implemented security measures to assess compliance with the Cybersecurity Law, subordinate legislation, and applicable EU legislation.

Equipment assessment - Evaluating the technical characteristics, configuration, and security properties of information-processing and communications equipment against applicable requirements.

Premises assessment - Evaluating the physical security, technical conditions, and other security measures of premises to ensure the secure processing and storage of classified information.

Cryptographic Administration Units supervision - Monitoring the activities of cryptographic equipment administration units, compliance with established procedures, and implementation of security requirements.

Cryptographic equipment administration - Managing the use, distribution, inventory, storage, and related administrative procedures for cryptographic equipment in accordance with established requirements.

Maintenance and Adaptation of Infrastructure for Authorities Authorized to Block Domain Names

Domain Blocking in Accordance with the Provisions of the Cybersecurity Law

Automation - Automating DNS firewall administration, threat indicator updates, rule application, and monitoring processes.

Query and request handling - Handling inquiries from users and organizations concerning DNS firewall operation, domain blocking or allowlisting, and configuration.

Domain investigation - Verification of Domain Reputation, DNS Records, and Other Available Indicators to Assess Domain Trustworthiness and Identify Potential Malicious Activity