IR – Incident Response

NIST SP 800-53B – IR – Incident Response

1.Kravtext (engelskt original)#

IR-1 – Policy and Procedures#

• a. Develop, document, and disseminate to [organization-defined personnel or roles]:
  • 1. [organization-level or mission/business process-level or system-level] incident response policy that:
    • (a) Addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance; and
    • (b) Is consistent with applicable laws, executive orders, directives, regulations, policies, standards, and guidelines; and
  • 2. Procedures to facilitate the implementation of the incident response policy and the associated incident response controls;
• b. Designate an [organization-defined official] to manage the development, documentation, and dissemination of the incident response policy and procedures; and
• c. Review and update the current incident response:
  • 1. Policy [organization-defined frequency] and following [organization-defined events] ; and
  • 2. Procedures [organization-defined frequency] and following [organization-defined events].

IR-2 – Incident Response Training#

• a. Provide incident response training to system users consistent with assigned roles and responsibilities:
  • 1. Within [organization-defined time period] of assuming an incident response role or responsibility or acquiring system access;
  • 2. When required by system changes; and
  • 3. [organization-defined frequency] thereafter; and
• b. Review and update incident response training content [organization-defined frequency] and following [organization-defined events].

IR-3 – Incident Response Testing#

Test the effectiveness of the incident response capability for the system [organization-defined frequency] using the following tests: [organization-defined tests].

IR-3(2) – Coordination with Related Plans

Coordinate incident response testing with organizational elements responsible for related plans.

IR-4 – Incident Handling#

• a. Implement an incident handling capability for incidents that is consistent with the incident response plan and includes preparation, detection and analysis, containment, eradication, and recovery;
• b. Coordinate incident handling activities with contingency planning activities;
• c. Incorporate lessons learned from ongoing incident handling activities into incident response procedures, training, and testing, and implement the resulting changes accordingly; and
• d. Ensure the rigor, intensity, scope, and results of incident handling activities are comparable and predictable across the organization.

IR-4(1) – Automated Incident Handling Processes

Support the incident handling process using [organization-defined automated mechanisms].

IR-5 – Incident Monitoring#

Track and document incidents.

IR-6 – Incident Reporting#

• a. Require personnel to report suspected incidents to the organizational incident response capability within [organization-defined time period] ; and
• b. Report incident information to [organization-defined authorities].

IR-6(1) – Automated Reporting

Report incidents using [organization-defined automated mechanisms].

IR-6(3) – Supply Chain Coordination

Provide incident information to the provider of the product or service and other organizations involved in the supply chain or supply chain governance for systems or system components related to the incident.

IR-7 – Incident Response Assistance#

Provide an incident response support resource, integral to the organizational incident response capability, that offers advice and assistance to users of the system for the handling and reporting of incidents.

IR-7(1) – Automation Support for Availability of Information and Support

Increase the availability of incident response information and support using [organization-defined automated mechanisms].

IR-8 – Incident Response Plan#

• a. Develop an incident response plan that:
  • 1. Provides the organization with a roadmap for implementing its incident response capability;
  • 2. Describes the structure and organization of the incident response capability;
  • 3. Provides a high-level approach for how the incident response capability fits into the overall organization;
  • 4. Meets the unique requirements of the organization, which relate to mission, size, structure, and functions;
  • 5. Defines reportable incidents;
  • 6. Provides metrics for measuring the incident response capability within the organization;
  • 7. Defines the resources and management support needed to effectively maintain and mature an incident response capability;
  • 8. Addresses the sharing of incident information;
  • 9. Is reviewed and approved by [organization-defined personnel or roles][organization-defined frequency] ; and
  • 10. Explicitly designates responsibility for incident response to [organization-defined entities, personnel, or roles].
• b. Distribute copies of the incident response plan to [organization-defined incident response personnel];
• c. Update the incident response plan to address system and organizational changes or problems encountered during plan implementation, execution, or testing;
• d. Communicate incident response plan changes to [organization-defined incident response personnel (identified by name and/or by role) and organizational elements] ; and
• e. Protect the incident response plan from unauthorized disclosure and modification.

National Institute of Standards and Technology, OSCAL release 5.2.0. Republished courtesy of the National Institute of Standards and Technology. CC0 1.0. Source.