A significant incident in a large European organisation becomes, within hours, a set of legal obligations, each with its own recipient, trigger and clock: the national computer security incident response team (CSIRT), the financial supervisor, the data protection authority or a market surveillance authority must be told, while the people who know most are busy containing the incident. Meanwhile, attackers who use AI move from foothold to impact faster than a person can read the alert, so containment that waits for a meeting arrives too late.
This chapter treats two Categories of NIST CSF 2.0: RS.CO Incident Response Reporting and Communication, whose outcomes are that internal and external stakeholders are notified of incidents and that information is shared with designated stakeholders, and RS.MI Incident Mitigation, whose outcomes are that incidents are contained and eradicated (19, NIST, 2024). It shows how one incident record can start every applicable reporting clock under NIS 2, DORA, the AI Act and the data-protection regime, how AI can draft reports without becoming the author of record, and which containment and eradication actions AI may take, at which autonomy level. It begins where Chapter 20 ended, once the incident has been declared and scoped.
Each regime starts its clock from a different event, asks a different question and sends the answer to a different authority.
Primary topics explored
- Reporting across regimes
- AI-assisted communication
- Containment at machine speed
- Eradication
- Summary
- Sources
About AI Red Team
AI Red Team is Book 4 of The Transformed Architecture. It shows how large European enterprises and public authorities put artificial intelligence to work as an active part of cyber defence: AI-assisted red teaming and adversary emulation, red teaming of AI systems themselves, the AI-assisted security operations centre, detection engineering, threat intelligence, incident response and purple teaming, all under a lawful mandate and with evidence a supervisor can inspect.
It builds on the conclusions of Architecture as Code, AI Governance and AI Platform and Security.
CISOs, SOC leads, red and blue team practitioners, security architects, AI architects and technical decision-makers.
Gunnar Nordqvist
Conceived, directed and published the books of The Transformed Architecture.
Continue with the full chapter
Chapter 21: Incident Reporting, Communication and Mitigation in AI Red Team gives the detailed explanations, practical examples and implementation patterns behind this summary.
This whitepaper belongs to “Respond” and is one of 32 drawn from the manuscript.