+IR-05 [H] Incident Monitoring
---+IR-05(01) [H] Automated Tracking, Data Collection, and Analysis

IR-05 [H] Incident Monitoring

Control

Track and document incidents.

Discussion

Documenting incidents includes maintaining records about each incident, the status of the incident, and other pertinent information necessary for forensics as well as evaluating incident details, trends, and handling. Incident information can be obtained from a variety of sources, including network monitoring, incident reports, incident response teams, user complaints, supply chain partners, audit monitoring, physical access monitoring, and user and administrator reports. [IR-4](#ir-4) provides information on the types of incidents that are appropriate for monitoring.

Assessment Objective

  1. incidents are tracked;
  2. incidents are documented.

Assessment Method

Examine

Incident response policy procedures addressing incident monitoring incident response records and documentation incident response plan system security plan privacy plan other relevant documents or records

Interview

Organizational personnel with incident monitoring responsibilities organizational personnel with information security and privacy responsibilities

1. Forbhreathnú

IR-05(01) [H] Automated Tracking, Data Collection, and Analysis

Control

Track incidents and collect and analyze incident information using [Assignement: organization-defined automated mechanisms].

Discussion

Automated mechanisms for tracking incidents and collecting and analyzing incident information include Computer Incident Response Centers or other electronic databases of incidents and network monitoring devices.

Assessment Objective

  1. incidents are tracked using [Assignement: automated mechanisms];
  2. incident information is collected using [Assignement: automated mechanisms];
  3. incident information is analyzed using [Assignement: automated mechanisms].

Assessment Method

Examine

Incident response policy procedures addressing incident monitoring incident response records and documentation system security plan incident response plan other relevant documents or records

Interview

Organizational personnel with incident monitoring responsibilities organizational personnel with information security responsibilities

1.1 Tagairtí

1.2 Ceanglais aitheanta

1.3 Rialacháin ghaolmhara

2. Ceanglais aitheanta

Ceanglais

3. Rialacháin ghaolmhara

Rialacháin

Saincheisteanna nasctha

Naisc
is blocked by IR-05 [H] Incident Monitoring – Assessment Procedure
is blocked by Situational Awareness For Incidents