Detections
Analytics
800-53|IR-4
Title
INCIDENT HANDLINGDescription
The organization:Supplemental
Organizations recognize that incident response capability is dependent on the capabilities of organizational information systems and the mission/business processes being supported by those systems. Therefore, organizations consider incident response as part of the definition, design, and development of mission/business processes and information systems. Incident-related information can be obtained from a variety of sources including, for example, audit monitoring, network monitoring, physical access monitoring, user/administrator reports, and reported supply chain events. Effective incident handling capability includes coordination among many organizational entities including, for example, mission/business owners, information system owners, authorizing officials, human resources offices, physical and personnel security offices, legal departments, operations personnel, procurement offices, and the risk executive (function).Reference Item Details
Reference: NIST 800-53 - Security and Privacy Controls for Federal Information Systems and Organizations
Related: AU-6,CM-6,CP-2,CP-4,IR-2,IR-3,IR-8,PE-6,SC-5,SC-7,SI-3,SI-4,SI-7
Category: INCIDENT RESPONSE
Family: INCIDENT RESPONSE
Priority: P1
Baseline Impact: LOW,MODERATE,HIGH
Audit Items
View all Reference Audit Items