IR-4 Incident Handling
a. Implement an incident handling capability for incidents that is consistent with the incident response plan and includes preparation, detection and analysis, containment, eradication, and recovery; b. Coordinate incident handling activities with contingency planning activities; c. Incorporate lessons learned from ongoing incident handling activities into incident response procedures, training, and testing, and implement the resulting changes accordingly; and d. Ensure the rigor, intensity, scope, and results of incident handling activities are comparable and predictable across the organization.
Source: NIST SP 800-53 Rev 5, IR-4. The statement above is our statement of the clause, read from the published text and cited so you can check it against the official text, not the instrument verbatim. Open NIST SP 800-53 Rev 5 in the compliance library.
Base controls and their enhancements. Which apply follows the baseline you are assessed against (for example FedRAMP Moderate or High, or the low, moderate and high baselines of SP 800-53B). Text in square brackets is a parameter your organisation sets.
These are the artefacts auditors commonly ask for on this requirement, our guidance rather than text from the standard. Your assessor decides what is sufficient in your context, and asks for samples across the period when a report covers one.
system holds itEvidence a system already holds
- Test of Incident handling capability for the organization · Document repository
periodic reviewEvidence produced at each review
none for this control
governing documentDocuments that govern the control
- Incident response policy · Policy repository / GRC workspace
- Contingency planning policy · Policy repository / GRC workspace
- Procedures addressing incident handling · Policy repository / GRC workspace
- Incident response plan · Policy repository / GRC workspace
- Contingency plan · Policy repository / GRC workspace
- System security plan · Policy repository / GRC workspace
- Privacy plan · Policy repository / GRC workspace
First move
Common gaps auditors find
- Incident handling capability lacks documented containment and eradication procedures required by a
- Lessons learned from handled incidents were not incorporated into incident response procedures, training and testing, contrary to c
Do this for your whole sheet
Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.
Build my evidence sheetIR-3(3) Incident Response Testing | Continuous Improvement · IR-4(1) Incident Handling | Automated Incident Handling Processes