# SEC10: How do you anticipate, respond to, and recover from incidents?

## References

- [AWS SEC10](https://docs.aws.amazon.com/wellarchitected/latest/framework/sec-10.html)

## Date

2025-11-27

## Focus Area

Incident Response

## Tổng quan

SEC10 tập trung vào incident response capabilities.

## Best Practices

| BP | Name | Description |
|----|------|-------------|
| [SEC10-BP01](SEC10-BP01-Identify-Key-Personnel.md) | Identify key personnel | IR team identified |
| [SEC10-BP02](SEC10-BP02-Develop-Incident-Plans.md) | Develop incident plans | IR playbooks |
| [SEC10-BP03](SEC10-BP03-Prepare-Forensic-Capabilities.md) | Forensic capabilities | Forensic readiness |
| [SEC10-BP04](SEC10-BP04-Develop-Recovery-Plans.md) | Recovery plans | Containment and recovery |
| [SEC10-BP05](SEC10-BP05-Pre-Provision-Access.md) | Pre-provision access | IR access ready |
| [SEC10-BP06](SEC10-BP06-Run-Simulations.md) | Run simulations | IR drills |
| [SEC10-BP07](SEC10-BP07-Create-Automated-Alerts.md) | Automated alerts | Security alerting |

## Checklist

- [ ] IR team identified
- [ ] IR playbooks documented
- [ ] Forensic capabilities ready
- [ ] IR drills conducted
- [ ] Communication plans ready
