+IR Incident Response
---+IR-01 Policy and Procedures
---+IR-02 Incident Response Training
------+IR-02(01) Simulated Events
------+IR-02(02) Automated Training Environments
------+IR-02(03) Breach
---+IR-03 Incident Response Testing
------+IR-03(01) Automated Testing
------+IR-03(02) Coordination with Related Plans
------+IR-03(03) Continuous Improvement
---+IR-04 Incident Handling
------+IR-04(01) Automated Incident Handling Processes
------+IR-04(02) Dynamic Reconfiguration
------+IR-04(03) Continuity of Operations
------+IR-04(04) Information Correlation
------+IR-04(05) Automatic Disabling of System
------+IR-04(06) Insider Threats
------+IR-04(07) Insider Threats — Intra-organization Coordination
------+IR-04(08) Correlation with External Organizations
------+IR-04(09) Dynamic Response Capability
------+IR-04(10) Supply Chain Coordination
------+IR-04(11) Integrated Incident Response Team
------+IR-04(12) Malicious Code and Forensic Analysis
------+IR-04(13) Behavior Analysis
------+IR-04(14) Security Operations Center
------+IR-04(15) Public Relations and Reputation Repair
---+IR-05 Incident Monitoring
------+IR-05(01) Automated Tracking, Data Collection, and Analysis
---+IR-06 Incident Reporting
------+IR-06(01) Automated Reporting
------+IR-06(02) Vulnerabilities Related to Incidents
------+IR-06(03) Supply Chain Coordination
---+IR-07 Incident Response Assistance
------+IR-07(01) Automation Support for Availability of Information and Support
------+IR-07(02) Coordination with External Providers
---+IR-08 Incident Response Plan
------+IR-08(01) Breaches
---+IR-09 Information Spillage Response
------+IR-09(02) Training
------+IR-09(03) Post-spill Operations
------+IR-09(04) Exposure to Unauthorized Personnel
---+IR-10 Integrated Information Security Analysis Team

IR Incident Response

Incident Response

1. Panoramica

IR-01 Policy and Procedures

Control

  1. Develop, document, and disseminate to [Assignement: organization-defined personnel or roles]:
    1. [Selection(one-or-more): organization-level; mission/business process-level; system-level] incident response policy that:
      1. Addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance; and
      2. Is consistent with applicable laws, executive orders, directives, regulations, policies, standards, and guidelines; and
    2. Procedures to facilitate the implementation of the incident response policy and the associated incident response controls;
  2. Designate an [Assignement: official] to manage the development, documentation, and dissemination of the incident response policy and procedures; and
  3. Review and update the current incident response:
    1. Policy [Assignement: frequency] and following [Assignement: events] ; and
    2. Procedures [Assignement: frequency] and following [Assignement: events].

Discussion

Incident response policy and procedures address the controls in the IR family that are implemented within systems and organizations. The risk management strategy is an important factor in establishing such policies and procedures. Policies and procedures contribute to security and privacy assurance. Therefore, it is important that security and privacy programs collaborate on the development of incident response policy and procedures. Security and privacy program policies and procedures at the organization level are preferable, in general, and may obviate the need for mission- or system-specific policies and procedures. The policy can be included as part of the general security and privacy policy or be represented by multiple policies that reflect the complex nature of organizations. Procedures can be established for security and privacy programs, for mission or business processes, and for systems, if needed. Procedures describe how the policies or controls are implemented and can be directed at the individual or role that is the object of the procedure. Procedures can be documented in system security and privacy plans or in one or more separate documents. Events that may precipitate an update to incident response policy and procedures include assessment or audit findings, security incidents or breaches, or changes in laws, executive orders, directives, regulations, policies, standards, and guidelines. Simply restating controls does not constitute an organizational policy or procedure.

Assessment Objective

    1. an incident response policy is developed and documented;
    2. the incident response policy is disseminated to [Assignement: personnel or roles];
    3. incident response procedures to facilitate the implementation of the incident response policy and associated incident response controls are developed and documented;
    4. the incident response procedures are disseminated to [Assignement: personnel or roles];
        1. the [Selection(one-or-more): organization-level; mission/business process-level; system-level] incident response policy addresses purpose;
        2. the [Selection(one-or-more): organization-level; mission/business process-level; system-level] incident response policy addresses scope;
        3. the [Selection(one-or-more): organization-level; mission/business process-level; system-level] incident response policy addresses roles;
        4. the [Selection(one-or-more): organization-level; mission/business process-level; system-level] incident response policy addresses responsibilities;
        5. the [Selection(one-or-more): organization-level; mission/business process-level; system-level] incident response policy addresses management commitment;
        6. the [Selection(one-or-more): organization-level; mission/business process-level; system-level] incident response policy addresses coordination among organizational entities;
        7. the [Selection(one-or-more): organization-level; mission/business process-level; system-level] incident response policy addresses compliance;
      2. the [Selection(one-or-more): organization-level; mission/business process-level; system-level] incident response policy is consistent with applicable laws, Executive Orders, directives, regulations, policies, standards, and guidelines;
  2. the [Assignement: official] is designated to manage the development, documentation, and dissemination of the incident response policy and procedures;
      1. the current incident response policy is reviewed and updated [Assignement: frequency];
      2. the current incident response policy is reviewed and updated following [Assignement: events];
      1. the current incident response procedures are reviewed and updated [Assignement: frequency];
      2. the current incident response procedures are reviewed and updated following [Assignement: events].

Assessment Method

Examine

Incident response policy and procedures system security plan privacy plan other relevant documents or records

Interview

Organizational personnel with incident response responsibilities organizational personnel with information security and privacy responsibilities
IR-02 Incident Response Training

Control

  1. Provide incident response training to system users consistent with assigned roles and responsibilities:
    1. Within [Assignement: time period] of assuming an incident response role or responsibility or acquiring system access;
    2. When required by system changes; and
    3. [Assignement: frequency] thereafter; and
  2. Review and update incident response training content [Assignement: frequency] and following [Assignement: events].

Discussion

Incident response training is associated with the assigned roles and responsibilities of organizational personnel to ensure that the appropriate content and level of detail are included in such training. For example, users may only need to know who to call or how to recognize an incident; system administrators may require additional training on how to handle incidents; and incident responders may receive more specific training on forensics, data collection techniques, reporting, system recovery, and system restoration. Incident response training includes user training in identifying and reporting suspicious activities from external and internal sources. Incident response training for users may be provided as part of [AT-2](#at-2) or [AT-3](#at-3) . Events that may precipitate an update to incident response training content include, but are not limited to, incident response plan testing or response to an actual incident (lessons learned), assessment or audit findings, or changes in applicable laws, executive orders, directives, regulations, policies, standards, and guidelines.

Assessment Objective

    1. incident response training is provided to system users consistent with assigned roles and responsibilities within [Assignement: time period] of assuming an incident response role or responsibility or acquiring system access;
    2. incident response training is provided to system users consistent with assigned roles and responsibilities when required by system changes;
    3. incident response training is provided to system users consistent with assigned roles and responsibilities [Assignement: frequency] thereafter;
    1. incident response training content is reviewed and updated [Assignement: frequency];
    2. incident response training content is reviewed and updated following [Assignement: events].

Assessment Method

Examine

Incident response policy procedures addressing incident response training incident response training curriculum incident response training materials privacy plan incident response plan incident response training records system security plan privacy plan other relevant documents or records

Interview

Organizational personnel with incident response training and operational responsibilities organizational personnel with information security and privacy responsibilities
IR-03 Incident Response Testing

Control

Test the effectiveness of the incident response capability for the system [Assignement: frequency] using the following tests: [Assignement: tests].

Discussion

Organizations test incident response capabilities to determine their effectiveness and identify potential weaknesses or deficiencies. Incident response testing includes the use of checklists, walk-through or tabletop exercises, and simulations (parallel or full interrupt). Incident response testing can include a determination of the effects on organizational operations and assets and individuals due to incident response. The use of qualitative and quantitative data aids in determining the effectiveness of incident response processes.

Assessment Objective

the effectiveness of the incident response capability for the system is tested [Assignement: frequency] using [Assignement: tests].

Assessment Method

Examine

Incident response policy contingency planning policy procedures addressing incident response testing procedures addressing contingency plan testing incident response testing material incident response test results incident response test plan incident response plan contingency plan system security plan privacy plan other relevant documents or records

Interview

Organizational personnel with incident response testing responsibilities organizational personnel with information security and privacy responsibilities
IR-04 Incident Handling

Control

  1. Implement an incident handling capability for incidents that is consistent with the incident response plan and includes preparation, detection and analysis, containment, eradication, and recovery;
  2. Coordinate incident handling activities with contingency planning activities;
  3. Incorporate lessons learned from ongoing incident handling activities into incident response procedures, training, and testing, and implement the resulting changes accordingly; and
  4. Ensure the rigor, intensity, scope, and results of incident handling activities are comparable and predictable across the organization.

Discussion

Organizations recognize that incident response capabilities are dependent on the capabilities of organizational systems and the mission and business processes being supported by those systems. Organizations consider incident response as part of the definition, design, and development of mission and business processes and systems. Incident-related information can be obtained from a variety of sources, including audit monitoring, physical access monitoring, and network monitoring; user or administrator reports; and reported supply chain events. An effective incident handling capability includes coordination among many organizational entities (e.g., mission or business owners, system owners, authorizing officials, human resources offices, physical security offices, personnel security offices, legal departments, risk executive [function], operations personnel, procurement offices). Suspected security incidents include the receipt of suspicious email communications that can contain malicious code. Suspected supply chain incidents include the insertion of counterfeit hardware or malicious code into organizational systems or system components. For federal agencies, an incident that involves personally identifiable information is considered a breach. A breach results in unauthorized disclosure, the loss of control, unauthorized acquisition, compromise, or a similar occurrence where a person other than an authorized user accesses or potentially accesses personally identifiable information or an authorized user accesses or potentially accesses such information for other than authorized purposes.

Assessment Objective

    1. an incident handling capability for incidents is implemented that is consistent with the incident response plan;
    2. the incident handling capability for incidents includes preparation;
    3. the incident handling capability for incidents includes detection and analysis;
    4. the incident handling capability for incidents includes containment;
    5. the incident handling capability for incidents includes eradication;
    6. the incident handling capability for incidents includes recovery;
  2. incident handling activities are coordinated with contingency planning activities;
    1. lessons learned from ongoing incident handling activities are incorporated into incident response procedures, training, and testing;
    2. the changes resulting from the incorporated lessons learned are implemented accordingly;
    1. the rigor of incident handling activities is comparable and predictable across the organization;
    2. the intensity of incident handling activities is comparable and predictable across the organization;
    3. the scope of incident handling activities is comparable and predictable across the organization;
    4. the results of incident handling activities are comparable and predictable across the organization.

Assessment Method

Examine

Incident response policy contingency planning policy procedures addressing incident handling incident response plan contingency plan system security plan privacy plan other relevant documents or records

Interview

Organizational personnel with incident handling responsibilities organizational personnel with contingency planning responsibilities organizational personnel with information security and privacy responsibilities
IR-05 Incident Monitoring

Control

Track and document incidents.

Discussion

Documenting incidents includes maintaining records about each incident, the status of the incident, and other pertinent information necessary for forensics as well as evaluating incident details, trends, and handling. Incident information can be obtained from a variety of sources, including network monitoring, incident reports, incident response teams, user complaints, supply chain partners, audit monitoring, physical access monitoring, and user and administrator reports. [IR-4](#ir-4) provides information on the types of incidents that are appropriate for monitoring.

Assessment Objective

  1. incidents are tracked;
  2. incidents are documented.

Assessment Method

Examine

Incident response policy procedures addressing incident monitoring incident response records and documentation incident response plan system security plan privacy plan other relevant documents or records

Interview

Organizational personnel with incident monitoring responsibilities organizational personnel with information security and privacy responsibilities
IR-06 Incident Reporting

Control

  1. Require personnel to report suspected incidents to the organizational incident response capability within [Assignement: time period] ; and
  2. Report incident information to [Assignement: authorities].

Discussion

The types of incidents reported, the content and timeliness of the reports, and the designated reporting authorities reflect applicable laws, executive orders, directives, regulations, policies, standards, and guidelines. Incident information can inform risk assessments, control effectiveness assessments, security requirements for acquisitions, and selection criteria for technology products.

Assessment Objective

  1. personnel is/are required to report suspected incidents to the organizational incident response capability within [Assignement: time period];
  2. incident information is reported to [Assignement: authorities].

Assessment Method

Examine

Incident response policy procedures addressing incident reporting incident reporting records and documentation incident response plan system security plan privacy plan other relevant documents or records

Interview

Organizational personnel with incident reporting responsibilities organizational personnel with information security and privacy responsibilities personnel who have/should have reported incidents personnel (authorities) to whom incident information is to be reported system users
IR-07 Incident Response Assistance

Control

Provide an incident response support resource, integral to the organizational incident response capability, that offers advice and assistance to users of the system for the handling and reporting of incidents.

Discussion

Incident response support resources provided by organizations include help desks, assistance groups, automated ticketing systems to open and track incident response tickets, and access to forensics services or consumer redress services, when required.

Assessment Objective

  1. an incident response support resource, integral to the organizational incident response capability, is provided;
  2. the incident response support resource offers advice and assistance to users of the system for the response and reporting of incidents.

Assessment Method

Examine

Incident response policy procedures addressing incident response assistance incident response plan system security plan privacy plan other relevant documents or records

Interview

Organizational personnel with incident response assistance and support responsibilities organizational personnel with access to incident response support and assistance capability organizational personnel with information security and privacy responsibilities
IR-08 Incident Response Plan

Control

  1. Develop an incident response plan that:
    1. Provides the organization with a roadmap for implementing its incident response capability;
    2. Describes the structure and organization of the incident response capability;
    3. Provides a high-level approach for how the incident response capability fits into the overall organization;
    4. Meets the unique requirements of the organization, which relate to mission, size, structure, and functions;
    5. Defines reportable incidents;
    6. Provides metrics for measuring the incident response capability within the organization;
    7. Defines the resources and management support needed to effectively maintain and mature an incident response capability;
    8. Addresses the sharing of incident information;
    9. Is reviewed and approved by [Assignement: personnel or roles] [Assignement: frequency] ; and
    10. Explicitly designates responsibility for incident response to [Assignement: entities, personnel, or roles].
  2. Distribute copies of the incident response plan to [Assignement: incident response personnel];
  3. Update the incident response plan to address system and organizational changes or problems encountered during plan implementation, execution, or testing;
  4. Communicate incident response plan changes to [Assignement: organization-defined incident response personnel (identified by name and/or by role) and organizational elements] ; and
  5. Protect the incident response plan from unauthorized disclosure and modification.

Discussion

It is important that organizations develop and implement a coordinated approach to incident response. Organizational mission and business functions determine the structure of incident response capabilities. As part of the incident response capabilities, organizations consider the coordination and sharing of information with external organizations, including external service providers and other organizations involved in the supply chain. For incidents involving personally identifiable information (i.e., breaches), include a process to determine whether notice to oversight organizations or affected individuals is appropriate and provide that notice accordingly.

Assessment Objective

    1. an incident response plan is developed that provides the organization with a roadmap for implementing its incident response capability;
    2. an incident response plan is developed that describes the structure and organization of the incident response capability;
    3. an incident response plan is developed that provides a high-level approach for how the incident response capability fits into the overall organization;
    4. an incident response plan is developed that meets the unique requirements of the organization with regard to mission, size, structure, and functions;
    5. an incident response plan is developed that defines reportable incidents;
    6. an incident response plan is developed that provides metrics for measuring the incident response capability within the organization;
    7. an incident response plan is developed that defines the resources and management support needed to effectively maintain and mature an incident response capability;
    8. an incident response plan is developed that addresses the sharing of incident information;
    9. an incident response plan is developed that is reviewed and approved by [Assignement: personnel or roles] [Assignement: frequency];
    10. an incident response plan is developed that explicitly designates responsibility for incident response to [Assignement: entities, personnel, or roles].
    1. copies of the incident response plan are distributed to [Assignement: incident response personnel];
    2. copies of the incident response plan are distributed to [Assignement: organizational elements];
  3. the incident response plan is updated to address system and organizational changes or problems encountered during plan implementation, execution, or testing;
    1. incident response plan changes are communicated to [Assignement: incident response personnel];
    2. incident response plan changes are communicated to [Assignement: organizational elements];
    1. the incident response plan is protected from unauthorized disclosure;
    2. the incident response plan is protected from unauthorized modification.

Assessment Method

Examine

Incident response policy procedures addressing incident response planning incident response plan system security plan privacy plan records of incident response plan reviews and approvals other relevant documents or records

Interview

Organizational personnel with incident response planning responsibilities organizational personnel with information security and privacy responsibilities
IR-09 Information Spillage Response

Control

Respond to information spills by:
  1. Assigning [Assignement: personnel or roles] with responsibility for responding to information spills;
  2. Identifying the specific information involved in the system contamination;
  3. Alerting [Assignement: personnel or roles] of the information spill using a method of communication not associated with the spill;
  4. Isolating the contaminated system or system component;
  5. Eradicating the information from the contaminated system or component;
  6. Identifying other systems or system components that may have been subsequently contaminated; and
  7. Performing the following additional actions: [Assignement: actions].

Discussion

Information spillage refers to instances where information is placed on systems that are not authorized to process such information. Information spills occur when information that is thought to be a certain classification or impact level is transmitted to a system and subsequently is determined to be of a higher classification or impact level. At that point, corrective action is required. The nature of the response is based on the classification or impact level of the spilled information, the security capabilities of the system, the specific nature of the contaminated storage media, and the access authorizations of individuals with authorized access to the contaminated system. The methods used to communicate information about the spill after the fact do not involve methods directly associated with the actual spill to minimize the risk of further spreading the contamination before such contamination is isolated and eradicated.

Assessment Objective

  1. [Assignement: personnel or roles] is/are assigned the responsibility to respond to information spills;
  2. the specific information involved in the system contamination is identified in response to information spills;
  3. [Assignement: personnel or roles] is/are alerted of the information spill using a method of communication not associated with the spill;
  4. the contaminated system or system component is isolated in response to information spills;
  5. the information is eradicated from the contaminated system or component in response to information spills;
  6. other systems or system components that may have been subsequently contaminated are identified in response to information spills;
  7. [Assignement: actions] are performed in response to information spills.

Assessment Method

Examine

Incident response policy procedures addressing information spillage incident response plan system security plan records of information spillage alerts/notifications list of personnel who should receive alerts of information spillage list of actions to be performed regarding information spillage other relevant documents or records

Interview

Organizational personnel with incident response responsibilities organizational personnel with information security responsibilities
IR-10 Integrated Information Security Analysis Team

Control

Discussion

Assessment Objective

Assessment Method

Examine

Interview

1.1 Riferimenti

1.2 Requisiti identificati

1.3 Regolamentazioni correlate

2. Requisiti identificati

Requisiti

3. Regolamentazioni correlate

Regolamentazioni