---
tags:
  - Rev5
  - Controls
---

<span class="picto">:lucide-computer:{ .machine title="This content is machine-generated from FedRAMP Machine-Readable Rules." }</span>

# Incident Response (IR)

This page contains all **40** controls and control enhancements in the Incident Response (IR) family from the vendored NIST SP 800-53 Revision 5 OSCAL catalog.

!!! info "Official NIST OSCAL source"
    - **Catalog version:** 5.2.0
    - **OSCAL version:** 1.2.2
    - **Catalog last modified:** May 11, 2026

## IR-01 (Policy and Procedures) { #ir-01 }

<div class="subset-applicability full-control-baselines" role="group" aria-label="FedRAMP Rev5 baseline applicability">
<span class="subset-applicability__group subset-applicability__group--classes"><span class="subset-applicability__label">FedRAMP Rev5 Baselines:</span> <span class="subset-applicability__values"><span class="subset-applicability__tag">Class B</span><span class="subset-applicability__tag">Class C</span><span class="subset-applicability__tag">Class D</span></span></span>
</div>

!!! quote ""
    - **a.** Develop, document, and disseminate to [Assignment: organization-defined personnel or roles]:
        - **1.** [Selection: one or more of: organization-level; mission/business process-level; system-level] incident response policy that:
            - **(a)** Addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance; and
            - **(b)** Is consistent with applicable laws, executive orders, directives, regulations, policies, standards, and guidelines; and
        - **2.** Procedures to facilitate the implementation of the incident response policy and the associated incident response controls;
    - **b.** Designate an [Assignment: organization-defined official] to manage the development, documentation, and dissemination of the incident response policy and procedures; and
    - **c.** Review and update the current incident response:
        - **1.** Policy [Assignment: organization-defined frequency] and following [Assignment: organization-defined events]; and
        - **2.** Procedures [Assignment: organization-defined frequency] and following [Assignment: organization-defined events].

    ---

    !!! info ""
        **FedRAMP Guidance**

        Follow the FedRAMP Incident Evaluation and Communication rules.

    ---

    **External Link for Additional Information:** [myctrl.tools](https://myctrl.tools/frameworks/nist-800-53-r5/ir-1)

---

## IR-02 (Incident Response Training) { #ir-02 }

<div class="subset-applicability full-control-baselines" role="group" aria-label="FedRAMP Rev5 baseline applicability">
<span class="subset-applicability__group subset-applicability__group--classes"><span class="subset-applicability__label">FedRAMP Rev5 Baselines:</span> <span class="subset-applicability__values"><span class="subset-applicability__tag">Class B</span><span class="subset-applicability__tag">Class C</span><span class="subset-applicability__tag">Class D</span></span></span>
</div>

!!! quote ""
    - **a.** Provide incident response training to system users consistent with assigned roles and responsibilities:
        - **1.** Within [Assignment: organization-defined time period] of assuming an incident response role or responsibility or acquiring system access;
        - **2.** When required by system changes; and
        - **3.** [Assignment: organization-defined frequency] thereafter; and
    - **b.** Review and update incident response training content [Assignment: organization-defined frequency] and following [Assignment: organization-defined events].

    ---

    !!! info ""
        **FedRAMP Guidance**

        Follow the FedRAMP Incident Evaluation and Communication rules.

    ---

    **External Link for Additional Information:** [myctrl.tools](https://myctrl.tools/frameworks/nist-800-53-r5/ir-2)

---

## IR-02 (01) (Simulated Events) { #ir-02-01 }

<div class="subset-applicability full-control-baselines" role="group" aria-label="FedRAMP Rev5 baseline applicability">
<span class="subset-applicability__group subset-applicability__group--classes"><span class="subset-applicability__label">FedRAMP Rev5 Baselines:</span> <span class="subset-applicability__values"><span class="subset-applicability__tag">Class D</span></span></span>
</div>

!!! quote ""
    Incorporate simulated events into incident response training to facilitate the required response by personnel in crisis situations.

    ---

    !!! info ""
        **FedRAMP Guidance**

        Follow the FedRAMP Incident Evaluation and Communication rules.

    ---

    **External Link for Additional Information:** [myctrl.tools](https://myctrl.tools/frameworks/nist-800-53-r5/ir-2-1)

---

## IR-02 (02) (Automated Training Environments) { #ir-02-02 }

<div class="subset-applicability full-control-baselines" role="group" aria-label="FedRAMP Rev5 baseline applicability">
<span class="subset-applicability__group subset-applicability__group--classes"><span class="subset-applicability__label">FedRAMP Rev5 Baselines:</span> <span class="subset-applicability__values"><span class="subset-applicability__tag">Class D</span></span></span>
</div>

!!! quote ""
    Provide an incident response training environment using [Assignment: organization-defined automated mechanisms].

    ---

    !!! info ""
        **FedRAMP Guidance**

        Follow the FedRAMP Incident Evaluation and Communication rules.

    ---

    **External Link for Additional Information:** [myctrl.tools](https://myctrl.tools/frameworks/nist-800-53-r5/ir-2-2)

---

## IR-02 (03) (Breach) { #ir-02-03 }

!!! quote ""
    Provide incident response training on how to identify and respond to a breach, including the organization’s process for reporting a breach.

    ---

    _This control does not have additional FedRAMP guidance or FedRAMP-assigned parameter values._

    ---

    **External Link for Additional Information:** [myctrl.tools](https://myctrl.tools/frameworks/nist-800-53-r5/ir-2-3)

---

## IR-03 (Incident Response Testing) { #ir-03 }

<div class="subset-applicability full-control-baselines" role="group" aria-label="FedRAMP Rev5 baseline applicability">
<span class="subset-applicability__group subset-applicability__group--classes"><span class="subset-applicability__label">FedRAMP Rev5 Baselines:</span> <span class="subset-applicability__values"><span class="subset-applicability__tag">Class C</span><span class="subset-applicability__tag">Class D</span></span></span>
</div>

!!! quote ""
    Test the effectiveness of the incident response capability for the system [Assignment: organization-defined frequency] using the following tests: [Assignment: organization-defined tests].

    ---

    !!! info ""
        **FedRAMP Guidance**

        Follow the FedRAMP Incident Evaluation and Communication rules.

    ---

    **External Link for Additional Information:** [myctrl.tools](https://myctrl.tools/frameworks/nist-800-53-r5/ir-3)

---

## IR-03 (01) (Automated Testing) { #ir-03-01 }

!!! quote ""
    Test the incident response capability using [Assignment: organization-defined automated mechanisms].

    ---

    _This control does not have additional FedRAMP guidance or FedRAMP-assigned parameter values._

    ---

    **External Link for Additional Information:** [myctrl.tools](https://myctrl.tools/frameworks/nist-800-53-r5/ir-3-1)

---

## IR-03 (02) (Coordination with Related Plans) { #ir-03-02 }

<div class="subset-applicability full-control-baselines" role="group" aria-label="FedRAMP Rev5 baseline applicability">
<span class="subset-applicability__group subset-applicability__group--classes"><span class="subset-applicability__label">FedRAMP Rev5 Baselines:</span> <span class="subset-applicability__values"><span class="subset-applicability__tag">Class C</span><span class="subset-applicability__tag">Class D</span></span></span>
</div>

!!! quote ""
    Coordinate incident response testing with organizational elements responsible for related plans.

    ---

    !!! info ""
        **FedRAMP Guidance**

        Follow the FedRAMP Incident Evaluation and Communication rules.

    ---

    **External Link for Additional Information:** [myctrl.tools](https://myctrl.tools/frameworks/nist-800-53-r5/ir-3-2)

---

## IR-03 (03) (Continuous Improvement) { #ir-03-03 }

!!! quote ""
    Use qualitative and quantitative data from testing to:
    
    - **(a)** Determine the effectiveness of incident response processes;
    - **(b)** Continuously improve incident response processes; and
    - **(c)** Provide incident response measures and metrics that are accurate, consistent, and in a reproducible format.

    ---

    _This control does not have additional FedRAMP guidance or FedRAMP-assigned parameter values._

    ---

    **External Link for Additional Information:** [myctrl.tools](https://myctrl.tools/frameworks/nist-800-53-r5/ir-3-3)

---

## IR-04 (Incident Handling) { #ir-04 }

<div class="subset-applicability full-control-baselines" role="group" aria-label="FedRAMP Rev5 baseline applicability">
<span class="subset-applicability__group subset-applicability__group--classes"><span class="subset-applicability__label">FedRAMP Rev5 Baselines:</span> <span class="subset-applicability__values"><span class="subset-applicability__tag">Class B</span><span class="subset-applicability__tag">Class C</span><span class="subset-applicability__tag">Class D</span></span></span>
</div>

!!! quote ""
    - **a.** Implement an incident handling capability for incidents that is consistent with the incident response plan and includes preparation, detection and analysis, containment, eradication, and recovery;
    - **b.** Coordinate incident handling activities with contingency planning activities;
    - **c.** Incorporate lessons learned from ongoing incident handling activities into incident response procedures, training, and testing, and implement the resulting changes accordingly; and
    - **d.** Ensure the rigor, intensity, scope, and results of incident handling activities are comparable and predictable across the organization.

    ---

    !!! info ""
        **FedRAMP Guidance**

        Follow the FedRAMP Incident Evaluation and Communication rules.

    ---

    **External Link for Additional Information:** [myctrl.tools](https://myctrl.tools/frameworks/nist-800-53-r5/ir-4)

---

## IR-04 (01) (Automated Incident Handling Processes) { #ir-04-01 }

<div class="subset-applicability full-control-baselines" role="group" aria-label="FedRAMP Rev5 baseline applicability">
<span class="subset-applicability__group subset-applicability__group--classes"><span class="subset-applicability__label">FedRAMP Rev5 Baselines:</span> <span class="subset-applicability__values"><span class="subset-applicability__tag">Class C</span><span class="subset-applicability__tag">Class D</span></span></span>
</div>

!!! quote ""
    Support the incident handling process using [Assignment: organization-defined automated mechanisms].

    ---

    !!! info ""
        **FedRAMP Guidance**

        Follow the FedRAMP Incident Evaluation and Communication rules.

    ---

    **External Link for Additional Information:** [myctrl.tools](https://myctrl.tools/frameworks/nist-800-53-r5/ir-4-1)

---

## IR-04 (02) (Dynamic Reconfiguration) { #ir-04-02 }

<div class="subset-applicability full-control-baselines" role="group" aria-label="FedRAMP Rev5 baseline applicability">
<span class="subset-applicability__group subset-applicability__group--classes"><span class="subset-applicability__label">FedRAMP Rev5 Baselines:</span> <span class="subset-applicability__values"><span class="subset-applicability__tag">Class D</span></span></span>
</div>

!!! quote ""
    Include the following types of dynamic reconfiguration for [Assignment: organization-defined system components] as part of the incident response capability: [Assignment: organization-defined types of dynamic reconfiguration].

    ---

    !!! info ""
        **FedRAMP Guidance**

        Follow the FedRAMP Incident Evaluation and Communication rules.

    ---

    **External Link for Additional Information:** [myctrl.tools](https://myctrl.tools/frameworks/nist-800-53-r5/ir-4-2)

---

## IR-04 (03) (Continuity of Operations) { #ir-04-03 }

!!! quote ""
    Identify [Assignment: organization-defined classes of incidents] and take the following actions in response to those incidents to ensure continuation of organizational mission and business functions: [Assignment: organization-defined actions].

    ---

    _This control does not have additional FedRAMP guidance or FedRAMP-assigned parameter values._

    ---

    **External Link for Additional Information:** [myctrl.tools](https://myctrl.tools/frameworks/nist-800-53-r5/ir-4-3)

---

## IR-04 (04) (Information Correlation) { #ir-04-04 }

<div class="subset-applicability full-control-baselines" role="group" aria-label="FedRAMP Rev5 baseline applicability">
<span class="subset-applicability__group subset-applicability__group--classes"><span class="subset-applicability__label">FedRAMP Rev5 Baselines:</span> <span class="subset-applicability__values"><span class="subset-applicability__tag">Class D</span></span></span>
</div>

!!! quote ""
    Correlate incident information and individual incident responses to achieve an organization-wide perspective on incident awareness and response.

    ---

    !!! info ""
        **FedRAMP Guidance**

        Follow the FedRAMP Incident Evaluation and Communication rules.

    ---

    **External Link for Additional Information:** [myctrl.tools](https://myctrl.tools/frameworks/nist-800-53-r5/ir-4-4)

---

## IR-04 (05) (Automatic Disabling of System) { #ir-04-05 }

!!! quote ""
    Implement a configurable capability to automatically disable the system if [Assignment: organization-defined security violations] are detected.

    ---

    _This control does not have additional FedRAMP guidance or FedRAMP-assigned parameter values._

    ---

    **External Link for Additional Information:** [myctrl.tools](https://myctrl.tools/frameworks/nist-800-53-r5/ir-4-5)

---

## IR-04 (06) (Insider Threats) { #ir-04-06 }

<div class="subset-applicability full-control-baselines" role="group" aria-label="FedRAMP Rev5 baseline applicability">
<span class="subset-applicability__group subset-applicability__group--classes"><span class="subset-applicability__label">FedRAMP Rev5 Baselines:</span> <span class="subset-applicability__values"><span class="subset-applicability__tag">Class D</span></span></span>
</div>

!!! quote ""
    Implement an incident handling capability for incidents involving insider threats.

    ---

    !!! info ""
        **FedRAMP Guidance**

        Follow the FedRAMP Incident Evaluation and Communication rules.

    ---

    **External Link for Additional Information:** [myctrl.tools](https://myctrl.tools/frameworks/nist-800-53-r5/ir-4-6)

---

## IR-04 (07) (Insider Threats — Intra-organization Coordination) { #ir-04-07 }

!!! quote ""
    Coordinate an incident handling capability for insider threats that includes the following organizational entities [Assignment: organization-defined entities].

    ---

    _This control does not have additional FedRAMP guidance or FedRAMP-assigned parameter values._

    ---

    **External Link for Additional Information:** [myctrl.tools](https://myctrl.tools/frameworks/nist-800-53-r5/ir-4-7)

---

## IR-04 (08) (Correlation with External Organizations) { #ir-04-08 }

!!! quote ""
    Coordinate with [Assignment: organization-defined external organizations] to correlate and share [Assignment: organization-defined incident information] to achieve a cross-organization perspective on incident awareness and more effective incident responses.

    ---

    _This control does not have additional FedRAMP guidance or FedRAMP-assigned parameter values._

    ---

    **External Link for Additional Information:** [myctrl.tools](https://myctrl.tools/frameworks/nist-800-53-r5/ir-4-8)

---

## IR-04 (09) (Dynamic Response Capability) { #ir-04-09 }

!!! quote ""
    Employ [Assignment: organization-defined dynamic response capabilities] to respond to incidents.

    ---

    _This control does not have additional FedRAMP guidance or FedRAMP-assigned parameter values._

    ---

    **External Link for Additional Information:** [myctrl.tools](https://myctrl.tools/frameworks/nist-800-53-r5/ir-4-9)

---

## IR-04 (10) (Supply Chain Coordination) { #ir-04-10 }

!!! quote ""
    Coordinate incident handling activities involving supply chain events with other organizations involved in the supply chain.

    ---

    _This control does not have additional FedRAMP guidance or FedRAMP-assigned parameter values._

    ---

    **External Link for Additional Information:** [myctrl.tools](https://myctrl.tools/frameworks/nist-800-53-r5/ir-4-10)

---

## IR-04 (11) (Integrated Incident Response Team) { #ir-04-11 }

<div class="subset-applicability full-control-baselines" role="group" aria-label="FedRAMP Rev5 baseline applicability">
<span class="subset-applicability__group subset-applicability__group--classes"><span class="subset-applicability__label">FedRAMP Rev5 Baselines:</span> <span class="subset-applicability__values"><span class="subset-applicability__tag">Class D</span></span></span>
</div>

!!! quote ""
    Establish and maintain an integrated incident response team that can be deployed to any location identified by the organization in [Assignment: organization-defined time period].

    ---

    !!! info ""
        **FedRAMP Guidance**

        Follow the FedRAMP Incident Evaluation and Communication rules.

    ---

    **External Link for Additional Information:** [myctrl.tools](https://myctrl.tools/frameworks/nist-800-53-r5/ir-4-11)

---

## IR-04 (12) (Malicious Code and Forensic Analysis) { #ir-04-12 }

!!! quote ""
    Analyze malicious code and/or other residual artifacts remaining in the system after the incident.

    ---

    _This control does not have additional FedRAMP guidance or FedRAMP-assigned parameter values._

    ---

    **External Link for Additional Information:** [myctrl.tools](https://myctrl.tools/frameworks/nist-800-53-r5/ir-4-12)

---

## IR-04 (13) (Behavior Analysis) { #ir-04-13 }

!!! quote ""
    Analyze anomalous or suspected adversarial behavior in or related to [Assignment: organization-defined environments or resources].

    ---

    _This control does not have additional FedRAMP guidance or FedRAMP-assigned parameter values._

    ---

    **External Link for Additional Information:** [myctrl.tools](https://myctrl.tools/frameworks/nist-800-53-r5/ir-4-13)

---

## IR-04 (14) (Security Operations Center) { #ir-04-14 }

!!! quote ""
    Establish and maintain a security operations center.

    ---

    _This control does not have additional FedRAMP guidance or FedRAMP-assigned parameter values._

    ---

    **External Link for Additional Information:** [myctrl.tools](https://myctrl.tools/frameworks/nist-800-53-r5/ir-4-14)

---

## IR-04 (15) (Public Relations and Reputation Repair) { #ir-04-15 }

!!! quote ""
    - **(a)** Manage public relations associated with an incident; and
    - **(b)** Employ measures to repair the reputation of the organization.

    ---

    _This control does not have additional FedRAMP guidance or FedRAMP-assigned parameter values._

    ---

    **External Link for Additional Information:** [myctrl.tools](https://myctrl.tools/frameworks/nist-800-53-r5/ir-4-15)

---

## IR-05 (Incident Monitoring) { #ir-05 }

<div class="subset-applicability full-control-baselines" role="group" aria-label="FedRAMP Rev5 baseline applicability">
<span class="subset-applicability__group subset-applicability__group--classes"><span class="subset-applicability__label">FedRAMP Rev5 Baselines:</span> <span class="subset-applicability__values"><span class="subset-applicability__tag">Class B</span><span class="subset-applicability__tag">Class C</span><span class="subset-applicability__tag">Class D</span></span></span>
</div>

!!! quote ""
    Track and document incidents.

    ---

    !!! info ""
        **FedRAMP Guidance**

        Follow the FedRAMP Incident Evaluation and Communication rules.

    ---

    **External Link for Additional Information:** [myctrl.tools](https://myctrl.tools/frameworks/nist-800-53-r5/ir-5)

---

## IR-05 (01) (Automated Tracking, Data Collection, and Analysis) { #ir-05-01 }

<div class="subset-applicability full-control-baselines" role="group" aria-label="FedRAMP Rev5 baseline applicability">
<span class="subset-applicability__group subset-applicability__group--classes"><span class="subset-applicability__label">FedRAMP Rev5 Baselines:</span> <span class="subset-applicability__values"><span class="subset-applicability__tag">Class D</span></span></span>
</div>

!!! quote ""
    Track incidents and collect and analyze incident information using [Assignment: organization-defined automated mechanisms].

    ---

    !!! info ""
        **FedRAMP Guidance**

        Follow the FedRAMP Incident Evaluation and Communication rules.

    ---

    **External Link for Additional Information:** [myctrl.tools](https://myctrl.tools/frameworks/nist-800-53-r5/ir-5-1)

---

## IR-06 (Incident Reporting) { #ir-06 }

<div class="subset-applicability full-control-baselines" role="group" aria-label="FedRAMP Rev5 baseline applicability">
<span class="subset-applicability__group subset-applicability__group--classes"><span class="subset-applicability__label">FedRAMP Rev5 Baselines:</span> <span class="subset-applicability__values"><span class="subset-applicability__tag">Class B</span><span class="subset-applicability__tag">Class C</span><span class="subset-applicability__tag">Class D</span></span></span>
</div>

!!! quote ""
    - **a.** Require personnel to report suspected incidents to the organizational incident response capability within [Assignment: organization-defined time period]; and
    - **b.** Report incident information to [Assignment: organization-defined authorities].

    ---

    !!! info ""
        **FedRAMP Guidance**

        Follow the FedRAMP Incident Evaluation and Communication rules.

    ---

    **External Link for Additional Information:** [myctrl.tools](https://myctrl.tools/frameworks/nist-800-53-r5/ir-6)

---

## IR-06 (01) (Automated Reporting) { #ir-06-01 }

<div class="subset-applicability full-control-baselines" role="group" aria-label="FedRAMP Rev5 baseline applicability">
<span class="subset-applicability__group subset-applicability__group--classes"><span class="subset-applicability__label">FedRAMP Rev5 Baselines:</span> <span class="subset-applicability__values"><span class="subset-applicability__tag">Class C</span><span class="subset-applicability__tag">Class D</span></span></span>
</div>

!!! quote ""
    Report incidents using [Assignment: organization-defined automated mechanisms].

    ---

    !!! info ""
        **FedRAMP Guidance**

        Follow the FedRAMP Incident Evaluation and Communication rules.

    ---

    **External Link for Additional Information:** [myctrl.tools](https://myctrl.tools/frameworks/nist-800-53-r5/ir-6-1)

---

## IR-06 (02) (Vulnerabilities Related to Incidents) { #ir-06-02 }

!!! quote ""
    Report system vulnerabilities associated with reported incidents to [Assignment: organization-defined personnel or roles].

    ---

    _This control does not have additional FedRAMP guidance or FedRAMP-assigned parameter values._

    ---

    **External Link for Additional Information:** [myctrl.tools](https://myctrl.tools/frameworks/nist-800-53-r5/ir-6-2)

---

## IR-06 (03) (Supply Chain Coordination) { #ir-06-03 }

<div class="subset-applicability full-control-baselines" role="group" aria-label="FedRAMP Rev5 baseline applicability">
<span class="subset-applicability__group subset-applicability__group--classes"><span class="subset-applicability__label">FedRAMP Rev5 Baselines:</span> <span class="subset-applicability__values"><span class="subset-applicability__tag">Class C</span><span class="subset-applicability__tag">Class D</span></span></span>
</div>

!!! quote ""
    Provide incident information to the provider of the product or service and other organizations involved in the supply chain or supply chain governance for systems or system components related to the incident.

    ---

    !!! info ""
        **FedRAMP Guidance**

        Follow the FedRAMP Incident Evaluation and Communication rules.

    ---

    **External Link for Additional Information:** [myctrl.tools](https://myctrl.tools/frameworks/nist-800-53-r5/ir-6-3)

---

## IR-07 (Incident Response Assistance) { #ir-07 }

<div class="subset-applicability full-control-baselines" role="group" aria-label="FedRAMP Rev5 baseline applicability">
<span class="subset-applicability__group subset-applicability__group--classes"><span class="subset-applicability__label">FedRAMP Rev5 Baselines:</span> <span class="subset-applicability__values"><span class="subset-applicability__tag">Class B</span><span class="subset-applicability__tag">Class C</span><span class="subset-applicability__tag">Class D</span></span></span>
</div>

!!! quote ""
    Provide an incident response support resource, integral to the organizational incident response capability, that offers advice and assistance to users of the system for the handling and reporting of incidents.

    ---

    !!! info ""
        **FedRAMP Guidance**

        Follow the FedRAMP Incident Evaluation and Communication rules.

    ---

    **External Link for Additional Information:** [myctrl.tools](https://myctrl.tools/frameworks/nist-800-53-r5/ir-7)

---

## IR-07 (01) (Automation Support for Availability of Information and Support) { #ir-07-01 }

<div class="subset-applicability full-control-baselines" role="group" aria-label="FedRAMP Rev5 baseline applicability">
<span class="subset-applicability__group subset-applicability__group--classes"><span class="subset-applicability__label">FedRAMP Rev5 Baselines:</span> <span class="subset-applicability__values"><span class="subset-applicability__tag">Class C</span><span class="subset-applicability__tag">Class D</span></span></span>
</div>

!!! quote ""
    Increase the availability of incident response information and support using [Assignment: organization-defined automated mechanisms].

    ---

    !!! info ""
        **FedRAMP Guidance**

        Follow the FedRAMP Incident Evaluation and Communication rules.

    ---

    **External Link for Additional Information:** [myctrl.tools](https://myctrl.tools/frameworks/nist-800-53-r5/ir-7-1)

---

## IR-07 (02) (Coordination with External Providers) { #ir-07-02 }

!!! quote ""
    - **(a)** Establish a direct, cooperative relationship between its incident response capability and external providers of system protection capability; and
    - **(b)** Identify organizational incident response team members to the external providers.

    ---

    _This control does not have additional FedRAMP guidance or FedRAMP-assigned parameter values._

    ---

    **External Link for Additional Information:** [myctrl.tools](https://myctrl.tools/frameworks/nist-800-53-r5/ir-7-2)

---

## IR-08 (Incident Response Plan) { #ir-08 }

<div class="subset-applicability full-control-baselines" role="group" aria-label="FedRAMP Rev5 baseline applicability">
<span class="subset-applicability__group subset-applicability__group--classes"><span class="subset-applicability__label">FedRAMP Rev5 Baselines:</span> <span class="subset-applicability__values"><span class="subset-applicability__tag">Class B</span><span class="subset-applicability__tag">Class C</span><span class="subset-applicability__tag">Class D</span></span></span>
</div>

!!! quote ""
    - **a.** Develop an incident response plan that:
        - **1.** Provides the organization with a roadmap for implementing its incident response capability;
        - **2.** Describes the structure and organization of the incident response capability;
        - **3.** Provides a high-level approach for how the incident response capability fits into the overall organization;
        - **4.** Meets the unique requirements of the organization, which relate to mission, size, structure, and functions;
        - **5.** Defines reportable incidents;
        - **6.** Provides metrics for measuring the incident response capability within the organization;
        - **7.** Defines the resources and management support needed to effectively maintain and mature an incident response capability;
        - **8.** Addresses the sharing of incident information;
        - **9.** Is reviewed and approved by [Assignment: organization-defined personnel or roles] [Assignment: organization-defined frequency]; and
        - **10.** Explicitly designates responsibility for incident response to [Assignment: organization-defined entities, personnel, or roles].
    - **b.** Distribute copies of the incident response plan to [Assignment: organization-defined incident response personnel];
    - **c.** Update the incident response plan to address system and organizational changes or problems encountered during plan implementation, execution, or testing;
    - **d.** Communicate incident response plan changes to [Assignment: organization-defined incident response personnel (identified by name and/or by role) and organizational elements]; and
    - **e.** Protect the incident response plan from unauthorized disclosure and modification.

    ---

    !!! info ""
        **FedRAMP Guidance**

        Follow the FedRAMP Incident Evaluation and Communication rules.

    ---

    **External Link for Additional Information:** [myctrl.tools](https://myctrl.tools/frameworks/nist-800-53-r5/ir-8)

---

## IR-08 (01) (Breaches) { #ir-08-01 }

!!! quote ""
    Include the following in the Incident Response Plan for breaches involving personally identifiable information:
    
    - **(a)** A process to determine if notice to individuals or other organizations, including oversight organizations, is needed;
    - **(b)** An assessment process to determine the extent of the harm, embarrassment, inconvenience, or unfairness to affected individuals and any mechanisms to mitigate such harms; and
    - **(c)** Identification of applicable privacy requirements.

    ---

    _This control does not have additional FedRAMP guidance or FedRAMP-assigned parameter values._

    ---

    **External Link for Additional Information:** [myctrl.tools](https://myctrl.tools/frameworks/nist-800-53-r5/ir-8-1)

---

## IR-09 (Information Spillage Response) { #ir-09 }

<div class="subset-applicability full-control-baselines" role="group" aria-label="FedRAMP Rev5 baseline applicability">
<span class="subset-applicability__group subset-applicability__group--classes"><span class="subset-applicability__label">FedRAMP Rev5 Baselines:</span> <span class="subset-applicability__values"><span class="subset-applicability__tag">Class C</span><span class="subset-applicability__tag">Class D</span></span></span>
</div>

!!! quote ""
    Respond to information spills by:
    
    - **a.** Assigning [Assignment: organization-defined personnel or roles] with responsibility for responding to information spills;
    - **b.** Identifying the specific information involved in the system contamination;
    - **c.** Alerting [Assignment: organization-defined personnel or roles] of the information spill using a method of communication not associated with the spill;
    - **d.** Isolating the contaminated system or system component;
    - **e.** Eradicating the information from the contaminated system or component;
    - **f.** Identifying other systems or system components that may have been subsequently contaminated; and
    - **g.** Performing the following additional actions: [Assignment: organization-defined actions].

    ---

    !!! info ""
        **FedRAMP Guidance**

        Follow the FedRAMP Incident Evaluation and Communication rules.

    ---

    **External Link for Additional Information:** [myctrl.tools](https://myctrl.tools/frameworks/nist-800-53-r5/ir-9)

---

## IR-09 (02) (Training) { #ir-09-02 }

<div class="subset-applicability full-control-baselines" role="group" aria-label="FedRAMP Rev5 baseline applicability">
<span class="subset-applicability__group subset-applicability__group--classes"><span class="subset-applicability__label">FedRAMP Rev5 Baselines:</span> <span class="subset-applicability__values"><span class="subset-applicability__tag">Class C</span><span class="subset-applicability__tag">Class D</span></span></span>
</div>

!!! quote ""
    Provide information spillage response training [Assignment: organization-defined frequency].

    ---

    !!! info ""
        **FedRAMP Guidance**

        Follow the FedRAMP Incident Evaluation and Communication rules.

    ---

    **External Link for Additional Information:** [myctrl.tools](https://myctrl.tools/frameworks/nist-800-53-r5/ir-9-2)

---

## IR-09 (03) (Post-spill Operations) { #ir-09-03 }

<div class="subset-applicability full-control-baselines" role="group" aria-label="FedRAMP Rev5 baseline applicability">
<span class="subset-applicability__group subset-applicability__group--classes"><span class="subset-applicability__label">FedRAMP Rev5 Baselines:</span> <span class="subset-applicability__values"><span class="subset-applicability__tag">Class C</span><span class="subset-applicability__tag">Class D</span></span></span>
</div>

!!! quote ""
    Implement the following procedures to ensure that organizational personnel impacted by information spills can continue to carry out assigned tasks while contaminated systems are undergoing corrective actions: [Assignment: organization-defined procedures].

    ---

    !!! info ""
        **FedRAMP Guidance**

        Follow the FedRAMP Incident Evaluation and Communication rules.

    ---

    **External Link for Additional Information:** [myctrl.tools](https://myctrl.tools/frameworks/nist-800-53-r5/ir-9-3)

---

## IR-09 (04) (Exposure to Unauthorized Personnel) { #ir-09-04 }

<div class="subset-applicability full-control-baselines" role="group" aria-label="FedRAMP Rev5 baseline applicability">
<span class="subset-applicability__group subset-applicability__group--classes"><span class="subset-applicability__label">FedRAMP Rev5 Baselines:</span> <span class="subset-applicability__values"><span class="subset-applicability__tag">Class C</span><span class="subset-applicability__tag">Class D</span></span></span>
</div>

!!! quote ""
    Employ the following controls for personnel exposed to information not within assigned access authorizations: [Assignment: organization-defined controls].

    ---

    !!! info ""
        **FedRAMP Guidance**

        Follow the FedRAMP Incident Evaluation and Communication rules.

    ---

    **External Link for Additional Information:** [myctrl.tools](https://myctrl.tools/frameworks/nist-800-53-r5/ir-9-4)

---
