Incident¶

An incident ticket is created when a security event, service outage, or other disruption requires coordinated investigation and response. Incidents may be raised manually by a team member or escalated in place from an alert after triage confirms a genuine event.

The ticket captures detection details, affected systems, severity, and whether sensitive data (such as CUI) is potentially involved. All actions taken during containment, eradication, and recovery are documented directly on the ticket through notes and attachments, creating the authoritative record for post-incident review and regulatory reporting.

Evaluation and Reporting¶

Every incident is evaluated to determine whether it affects, or is likely to affect, the confidentiality or integrity of federal customer data -- such incidents are FedRAMP Reportable Incidents. The evaluating responder records the reportability determination and assigns a Potential Agency Impact N-rating (PAIN); a reportable incident whose PAIN rating is not promptly estimated defaults to PAIN 5. The PAIN rating sets the reporting clocks: affected parties receive an Initial Incident Report, Ongoing Incident Reports, and a Final Incident Report on PAIN-keyed timeframes, tracked as OLAs on the ticket.

Every incident ends in an After Action Report -- root cause, lessons learned, and corrective actions authored on the incident record and approved by the After Action Report Approvers CAB before the incident resolves.

See the Incident Response policy for the reporting timeframes, PAIN defaults, and the FedRAMP Security Inbox obligations.

Compliance Context¶

Incident tickets support overlapping requirements across FedRAMP and CMMC:

See the Incident Response playbook for detailed procedures.