Mythos Hardening Control · MRIS 2.0 · Applies to ISO/IEC 27001, TISAX® and IT-Grundschutz

MHC-11 SOAR-based tier 1 automation and parallel response playbooks

Shortens the response time to a security-relevant event to a level that no longer depends on human processing speed alone.

At a glance

Operational benefit: brings the response to unambiguous incidents down from hours to minutes, by running the fast, clear containment steps automatically — people concentrate on the ambiguous and serious cases. Target state from the Defined level (partially automated) or Managed (fully automated).
Policy affected: incident response policy.
Dependencies: presupposes reliable detection (MHC-05 supplies the signals); the automation layer itself must be hardened.
Effort drivers: depends on whether a SOAR platform is operated in-house or procured as a service, and on the number of playbooks. The actual effort depends on the organization's resources.
Primary metric: time to containment of an unambiguous incident (mean time to containment, MTTC).
Standards touched (no claim of fulfilment): ISO/IEC 27002 A.5.24/A.5.26; C5:2026 SIM-02/03; NIS2 IR No. 3.5; DORA Art. 17; NIST SP 800-61 Rev. 3.

Control statement

To unambiguous incidents the organization responds with predefined, SOAR-supported and at least partially automated procedures (playbooks) that initiate containment in under 60 minutes; ambiguous or serious cases are routed deliberately to people. The automation layer itself is secured. Advanced hardening (Managed level): fully automated containment of unambiguous incidents in under 10 minutes, together with regularly exercised handling of several simultaneous incidents — alternatively an MDR service with a contractually assured response time.

Purpose and threat relevance

AI-supported attacks run at machine speed: often only minutes pass between first access and damage. A purely human response chain — review the alert, assess, escalate, act — is too slow for that. At the same time, attackers increasingly run several attacks in parallel in order to overload the response. The protective objective is to automate the fast, unambiguous containment steps so that they take effect in minutes, and to be prepared for several simultaneous incidents. Important: the automation itself becomes a target and must be protected accordingly.

Effect across frameworks

These are the controls and requirements the MHC acts on. The classification shows how much each control loses its effect under AI-enabled attacks.

Effect across frameworks
Number	Title	Classification / Level
ISO/IEC 27001:2022, Annex A 4 controls
A.5.5	Contact with authorities	partially degraded
A.5.24	Information security incident management planning and preparation	partially degraded
A.5.25	Assessment and decision on information security events	friction-only
A.5.26	Response to information security incidents	partially degraded
TISAX® ISA 2027 1 controls
1.6.2	Handling of security events	partially degraded
IT-Grundschutz, MRIS.bd 1 requirements
MRIS.bd.1.A9	Automating Incident Response with Hardened Playbooks	Standard

All 93 controls in the analysis matrix · All 45 controls in the findings matrix · All 23 requirements of the module family

Maturity path

Initial: response playbooks documented; manual execution.
Defined: SOAR with partially automated playbooks; time to containment under 60 minutes.
Managed: fully automated containment of unambiguous incidents, time under 10 minutes; half-yearly exercises with several simultaneous incidents — alternatively an MDR service with a contractually assured response time.

Measurement and audit evidence

Metric: time to containment of an unambiguous incident (MTTC; guide value: under 10 minutes at high confidence).
Evidence: playbook definitions and logs, evidence of the hardening of the automation layer (trigger authentication, audit trail, approval rules), records of the multi-incident exercises or the service provider SLA.
Evidence logic (following ISO/IEC 27001, Clause 9): documented? — incident response policy, playbooks; responsible? — security operations or SOC lead; frequency? — continuous, exercises at least half-yearly; tolerance? — no automatic action with a large blast radius without human approval.

Typical mistakes

Automation is applied broadly without protecting the automation layer; unauthenticated triggers or floods of false alerts set off unintended containment.
Far-reaching actions run without human approval; a false alert then locks many accounts or isolates whole network areas.
Playbooks exist but there is no exercise for several simultaneous incidents; when it matters, a parallel attack overloads the response.
The playbooks are not maintained like source code (no version control, no review); errors and manipulation go unnoticed.

Delimitation and residual risk

Delimitation: concerns the response to detected incidents; detection itself is dealt with by MHC-05, and ongoing compliance checking by MHC-10.
Residual risk: the automation can become a target — attackers can probe trigger conditions, deliberately provoke false alerts, or turn containment actions against the organization itself; without the hardening described, the measure is not effective.
Effectiveness limit: SOAR does not replace robust detection, asset context and incident governance. Automation takes effect only once triggers, data quality, criticality logic, approval rules and fallback paths are defined and tested; actions with potentially high damage impact provide by default for human approval, simulation or staged execution.
ISO/IEC 27002:2022: A.5.5 Contact with authorities; A.5.24 Information security incident management planning and preparation; A.5.25 Assessment and decision on information security events; A.5.26 Response to information security incidents.
Framework: C5:2026 SIM-02/03; NIS2 IR No. 3.5; DORA Art. 17; NIST SP 800-61 Revision 3 (incident handling, aligned to CSF 2.0).

Implementation in detail

Organizational and technical implementation, implementation examples and the prioritization within the overall programme are described in the Implementation Guide.

Implementation Guide (PDF)Back to the MHC catalog