Skip to main content

💼 IR-4 Incident Handling

  • Contextual name: 💼 IR-4 Incident Handling
  • ID: /frameworks/nist-sp-800-53-r5/ir/04
  • Located in: 💼 IR Incident Response

Description​

a. Implement an incident handling capability for incidents that is consistent with the incident response plan and includes preparation, detection and analysis, containment, eradication, and recovery; b. Coordinate incident handling activities with contingency planning activities; c. Incorporate lessons learned from ongoing incident handling activities into incident response procedures, training, and testing, and implement the resulting changes accordingly; and d. Ensure the rigor, intensity, scope, and results of incident handling activities are comparable and predictable across the organization.

Similar​

  • Internal
    • ID: dec-c-7f432267

Similar Sections (Give Policies To)​

SectionSub SectionsInternal RulesPoliciesFlags
💼 FedRAMP High Security Controls → 💼 IR-4 Incident Handling (L)(M)(H)5
💼 FedRAMP Low Security Controls → 💼 IR-4 Incident Handling (L)(M)(H)
💼 NIST CSF v2.0 → 💼 DE.AE-02: Potentially adverse events are analyzed to better understand associated activities26
💼 NIST CSF v2.0 → 💼 DE.AE-03: Information is correlated from multiple sources26
💼 NIST CSF v2.0 → 💼 DE.AE-06: Information on adverse events is provided to authorized staff and tools33
💼 NIST CSF v2.0 → 💼 DE.AE-08: Incidents are declared when adverse events meet the defined incident criteria
💼 NIST CSF v2.0 → 💼 ID.IM-01: Improvements are identified from evaluations10
💼 NIST CSF v2.0 → 💼 ID.IM-02: Improvements are identified from security tests and exercises, including those done in coordination with suppliers and relevant third parties23
💼 NIST CSF v2.0 → 💼 ID.IM-03: Improvements are identified from execution of operational processes, procedures, and activities24
💼 NIST CSF v2.0 → 💼 RC.CO-03: Recovery activities and progress in restoring operational capabilities are communicated to designated internal and external stakeholders
💼 NIST CSF v2.0 → 💼 RC.CO-04: Public updates on incident recovery are shared using approved methods and messaging23
💼 NIST CSF v2.0 → 💼 RC.RP-01: The recovery portion of the incident response plan is executed once initiated from the incident response process2
💼 NIST CSF v2.0 → 💼 RC.RP-02: Recovery actions are selected, scoped, prioritized, and performed2
💼 NIST CSF v2.0 → 💼 RC.RP-06: The end of incident recovery is declared based on criteria, and incident-related documentation is completed
💼 NIST CSF v2.0 → 💼 RS.AN-03: Analysis is performed to establish what has taken place during an incident and the root cause of the incident
💼 NIST CSF v2.0 → 💼 RS.AN-06: Actions performed during an investigation are recorded, and the records' integrity and provenance are preserved
💼 NIST CSF v2.0 → 💼 RS.AN-07: Incident data and metadata are collected, and their integrity and provenance are preserved
💼 NIST CSF v2.0 → 💼 RS.AN-08: An incident's magnitude is estimated and validated
💼 NIST CSF v2.0 → 💼 RS.CO-02: Internal and external stakeholders are notified of incidents30
💼 NIST CSF v2.0 → 💼 RS.CO-03: Information is shared with designated internal and external stakeholders17
💼 NIST CSF v2.0 → 💼 RS.MA-02: Incident reports are triaged and validated22
💼 NIST CSF v2.0 → 💼 RS.MA-03: Incidents are categorized and prioritized
💼 NIST CSF v2.0 → 💼 RS.MA-04: Incidents are escalated or elevated as needed
💼 NIST CSF v2.0 → 💼 RS.MA-05: The criteria for initiating incident recovery are applied
💼 NIST CSF v2.0 → 💼 RS.MI-01: Incidents are contained7
💼 NIST CSF v2.0 → 💼 RS.MI-02: Incidents are eradicated7

Sub Sections​

SectionSub SectionsInternal RulesPoliciesFlags
💼 IR-4(1) Incident Handling _ Automated Incident Handling Processes
💼 IR-4(2) Incident Handling _ Dynamic Reconfiguration
💼 IR-4(3) Incident Handling _ Continuity of Operations
💼 IR-4(4) Incident Handling _ Information Correlation
💼 IR-4(5) Incident Handling _ Automatic Disabling of System
💼 IR-4(6) Incident Handling _ Insider Threats
💼 IR-4(7) Incident Handling _ Insider Threats — Intra-organization Coordination
💼 IR-4(8) Incident Handling _ Correlation with External Organizations
💼 IR-4(9) Incident Handling _ Dynamic Response Capability
💼 IR-4(10) Incident Handling _ Supply Chain Coordination
💼 IR-4(11) Incident Handling _ Integrated Incident Response Team
💼 IR-4(12) Incident Handling _ Malicious Code and Forensic Analysis
💼 IR-4(13) Incident Handling _ Behavior Analysis
💼 IR-4(14) Incident Handling _ Security Operations Center
💼 IR-4(15) Incident Handling _ Public Relations and Reputation Repair