IR-7 Incident Response Assistance
Provide IR support resource (help desk, support group) for incident handling assistance.
system holds itEvidence a system already holds
- Incident ticket samples covering detection, containment, and lessons learned · Ticketing / ITSM
periodic reviewEvidence produced at each review
none for this control
governing documentDocuments that govern the control
- Control implementation statement for IR-7 citing the system mission and inheritance from common controls · Document repository
- Forensic toolkit readiness checklist and chain of custody templates · Document repository
- Regulatory notification procedure with jurisdiction specific timelines · Policy repository / GRC workspace
- Incident response plan with severity definitions and escalation paths · Policy repository / GRC workspace
- Incident response team roster with on call rotation · Document repository
First move
Common gaps auditors find
- Severity criteria inconsistent across teams leading to under reporting
- Lessons learned captured but corrective actions not tracked to closure
- Notification timelines miss jurisdictional regulatory deadlines
- Third party incident responder retainer expired
Do this for your whole sheet
Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.
Build my evidence sheetIR-6(3) Incident Reporting | Supply Chain Coordination. Provide incident information to the provider of the product or service and other organizations involved in the supply chain or supply chain governance for systems or system components · IR-7(1) Incident Response Assistance | Automation Support for Availability of Information and Support. Increase the availability of incident response information and support using [Assignment: organization-defined automated mechanisms]