home || catalog: SP800-53rev3 / class: Operational / family: (IR) Incident Response ||
search controls:
search nistpubs:

AC
AT
AU
CA
CM
CP
IA
IR

IR-01
IR-02
IR-03
IR-04
IR-05
IR-06
IR-07
IR-08 *

MA
MP
PE
PL
PM
PS
RA
SA
SC
SI
MMMMM

  IR-08: Incident Response Plan  

base control objective:
The organization:
a. Develops an incident response plan that: - Provides the organization with a roadmap for implementing its incident response capability; - Describes the structure of the incident response capability; - Provides a high-level approach for how the incident response capability fits into the overall organization; - Meets the unique requirements of the organization, which relate to mission, size, structure, and functions; - Defines reportable incidents; - Provides metrics for measuring the incident response capability within the organization. - Defines the resources and management support needed to effectively maintain and mature an incident response capability; and - Is reviewed and approved by designated officials within the organization;
b. Distributes copies of the incident response plan to [Assignment: organization-defined list of incident response personnel and organizational elements]; and
c. Reviews the incident response plan [Assignment: organization-defined frequency];
d. Revises the incident response plan to address system/organizational changes or problems encountered during plan implementation, execution, or testing; and
e. Communicates incident response plan changes to [Assignment: organization-defined list of incident response personnel and organizational elements].

supplemental objective information:
It is important that organizations have a formal, focused, and coordinated approach to responding to incidents. The organization’s mission, strategies, and goals for incident response help determine the structure of its incident response capability.

enhancements to the base objective:

(1) None.

mapping to FIPS199 baseline:

  LOW: base     MOD: base     HIGH: base  

related (regimented) controls:

None.

documents referenced in SP800-53rev3 for IR-08:

None.

Document Date Status Title

Search SP800-53rev3 catalog: