---
tags:
  - 20x
  - Cloud Service Providers
  - Key Security Indicators
---

<span class="picto">:lucide-computer:{ .machine title="This content is machine-generated from FedRAMP Machine-Readable Rules." }</span>

# Incident Response






### Generating After Action Reports

??? abstract "KSI-INR-AAR"
    **Changelog:**


    - **2026-06-24:** Official launch of the FedRAMP Consolidated Rules for 2026.




!!! quote ""
    Incident after action reports are generated and lessons learned are persistently incorporated.



    **Related SP 800-53 Controls:** [IR-03](../../../reference/controls/incident-response.md#ir-03){ data-preview }, [IR-04](../../../reference/controls/incident-response.md#ir-04){ data-preview }, [IR-04 (01)](../../../reference/controls/incident-response.md#ir-04-01){ data-preview }, [IR-08](../../../reference/controls/incident-response.md#ir-08){ data-preview }

    ---
    **Terms:** [Incident](../../../definitions/#incident){ data-preview }, [Persistently](../../../definitions/#persistently){ data-preview }
### Reviewing Incident Response Procedures

??? abstract "KSI-INR-RIR"
    **Changelog:**


    - **2026-06-24:** Official launch of the FedRAMP Consolidated Rules for 2026.




!!! quote ""
    The effectiveness of documented incident response procedures is persistently reviewed.



    **Related SP 800-53 Controls:** [IR-04](../../../reference/controls/incident-response.md#ir-04){ data-preview }, [IR-04 (01)](../../../reference/controls/incident-response.md#ir-04-01){ data-preview }, [IR-06](../../../reference/controls/incident-response.md#ir-06){ data-preview }, [IR-06 (01)](../../../reference/controls/incident-response.md#ir-06-01){ data-preview }, [IR-06 (03)](../../../reference/controls/incident-response.md#ir-06-03){ data-preview }, [IR-07](../../../reference/controls/incident-response.md#ir-07){ data-preview }, [IR-07 (01)](../../../reference/controls/incident-response.md#ir-07-01){ data-preview }, [IR-08](../../../reference/controls/incident-response.md#ir-08){ data-preview }, [IR-08 (01)](../../../reference/controls/incident-response.md#ir-08-01){ data-preview }, [SI-04 (05)](../../../reference/controls/system-and-information-integrity.md#si-04-05){ data-preview }

    ---
    **Terms:** [Incident](../../../definitions/#incident){ data-preview }, [Persistently](../../../definitions/#persistently){ data-preview }, [Vulnerability Response](../../../definitions/#vulnerability-response){ data-preview }
### Reviewing Past Incidents

??? abstract "KSI-INR-RPI"
    **Changelog:**


    - **2026-06-24:** Official launch of the FedRAMP Consolidated Rules for 2026.




!!! quote ""
    Past incidents are persistently reviewed for patterns or vulnerabilities that were not previously apparent or identified.



    **Related SP 800-53 Controls:** [IR-03](../../../reference/controls/incident-response.md#ir-03){ data-preview }, [IR-04](../../../reference/controls/incident-response.md#ir-04){ data-preview }, [IR-04 (01)](../../../reference/controls/incident-response.md#ir-04-01){ data-preview }, [IR-05](../../../reference/controls/incident-response.md#ir-05){ data-preview }, [IR-08](../../../reference/controls/incident-response.md#ir-08){ data-preview }

    ---
    **Terms:** [Incident](../../../definitions/#incident){ data-preview }, [Persistently](../../../definitions/#persistently){ data-preview }, [Vulnerability](../../../definitions/#vulnerability){ data-preview }
