BaselineWatch
1196 requirements
Desk
Your fleet and your work Fleetyour releases and the hardware they run onTriagewhat needs a decisionWatchlistthe products and platforms you runSaved searchesthe lists you come back to
This instance Sourceswhat is read, how often, under what termsDigestthe daily or weekly summary, and alerts
How it is drawn Appearancethe look and the colour schemeBrandingthe mark this instance wears
Owner sign-in

NIST SP 800-53 (controls) 5.2.0

1196 requirements · published 2026-10-22
Changes in this version
AllACATAUCACMCPIAIRMAMPPEPLPMPSPTRASASCSISR
RefTitleText
IR-01 Policy and Procedures a. Develop, document, and disseminate to [Assignment: organization-defined personnel or roles]: 1. [Selection (one or more): organization-level; mission/business process-level; system-level] incident response policy that: (a) Addresses purp
IR-02 Incident Response Training a. Provide incident response training to system users consistent with assigned roles and responsibilities: 1. Within [Assignment: time period] of assuming an incident response role or responsibility or acquiring system access; 2. When requi
IR-02(01)
in IR-2
 Simulated Events Incorporate simulated events into incident response training to facilitate the required response by personnel in crisis situations.
IR-02(02)
in IR-2
 Automated Training Environments Provide an incident response training environment using [Assignment: automated mechanisms].
IR-02(03)
in IR-2
 Breach Provide incident response training on how to identify and respond to a breach, including the organization’s process for reporting a breach.
IR-03 Incident Response Testing Test the effectiveness of the incident response capability for the system [Assignment: frequency] using the following tests: [Assignment: tests].
IR-03(01)
in IR-3
 Automated Testing Test the incident response capability using [Assignment: automated mechanisms].
IR-03(02)
in IR-3
 Coordination with Related Plans Coordinate incident response testing with organizational elements responsible for related plans.
IR-03(03)
in IR-3
 Continuous Improvement Use qualitative and quantitative data from testing to: (a) Determine the effectiveness of incident response processes; (b) Continuously improve incident response processes; and (c) Provide incident response measures and metrics that are acc
IR-04 Incident Handling a. Implement an incident handling capability for incidents that is consistent with the incident response plan and includes preparation, detection and analysis, containment, eradication, and recovery; b. Coordinate incident handling activiti
IR-04(01)
in IR-4
 Automated Incident Handling Processes Support the incident handling process using [Assignment: automated mechanisms].
IR-04(02)
in IR-4
 Dynamic Reconfiguration Include the following types of dynamic reconfiguration for [Assignment: system components] as part of the incident response capability: [Assignment: types of dynamic reconfiguration].
IR-04(03)
in IR-4
 Continuity of Operations Identify [Assignment: classes of incidents] and take the following actions in response to those incidents to ensure continuation of organizational mission and business functions: [Assignment: actions].
IR-04(04)
in IR-4
 Information Correlation Correlate incident information and individual incident responses to achieve an organization-wide perspective on incident awareness and response.
IR-04(05)
in IR-4
 Automatic Disabling of System Implement a configurable capability to automatically disable the system if [Assignment: security violations] are detected.
IR-04(06)
in IR-4
 Insider Threats Implement an incident handling capability for incidents involving insider threats.
IR-04(07)
in IR-4
 Insider Threats — Intra-organization Coordination Coordinate an incident handling capability for insider threats that includes the following organizational entities [Assignment: entities].
IR-04(08)
in IR-4
 Correlation with External Organizations Coordinate with [Assignment: external organizations] to correlate and share [Assignment: incident information] to achieve a cross-organization perspective on incident awareness and more effective incident responses.
IR-04(09)
in IR-4
 Dynamic Response Capability Employ [Assignment: dynamic response capabilities] to respond to incidents.
IR-04(10)
in IR-4
 Supply Chain Coordination Coordinate incident handling activities involving supply chain events with other organizations involved in the supply chain.
IR-04(11)
in IR-4
 Integrated Incident Response Team Establish and maintain an integrated incident response team that can be deployed to any location identified by the organization in [Assignment: time period].
IR-04(12)
in IR-4
 Malicious Code and Forensic Analysis Analyze malicious code and/or other residual artifacts remaining in the system after the incident.
IR-04(13)
in IR-4
 Behavior Analysis Analyze anomalous or suspected adversarial behavior in or related to [Assignment: environments or resources].
IR-04(14)
in IR-4
 Security Operations Center Establish and maintain a security operations center.
IR-04(15)
in IR-4
 Public Relations and Reputation Repair (a) Manage public relations associated with an incident; and (b) Employ measures to repair the reputation of the organization.
IR-05 Incident Monitoring Track and document incidents.
IR-05(01)
in IR-5
 Automated Tracking, Data Collection, and Analysis Track incidents and collect and analyze incident information using [Assignment: organization-defined automated mechanisms].
IR-06 Incident Reporting a. Require personnel to report suspected incidents to the organizational incident response capability within [Assignment: time period] ; and b. Report incident information to [Assignment: authorities].
IR-06(01)
in IR-6
 Automated Reporting Report incidents using [Assignment: automated mechanisms].
IR-06(02)
in IR-6
 Vulnerabilities Related to Incidents Report system vulnerabilities associated with reported incidents to [Assignment: personnel or roles].
IR-06(03)
in IR-6
 Supply Chain Coordination Provide incident information to the provider of the product or service and other organizations involved in the supply chain or supply chain governance for systems or system components related to the incident.
IR-07 Incident Response Assistance Provide an incident response support resource, integral to the organizational incident response capability, that offers advice and assistance to users of the system for the handling and reporting of incidents.
IR-07(01)
in IR-7
 Automation Support for Availability of Information and Support Increase the availability of incident response information and support using [Assignment: automated mechanisms].
IR-07(02)
in IR-7
 Coordination with External Providers (a) Establish a direct, cooperative relationship between its incident response capability and external providers of system protection capability; and (b) Identify organizational incident response team members to the external providers.
IR-08 Incident Response Plan a. Develop an incident response plan that: 1. Provides the organization with a roadmap for implementing its incident response capability; 2. Describes the structure and organization of the incident response capability; 3. Provides a high-le
IR-08(01)
in IR-8
 Breaches Include the following in the Incident Response Plan for breaches involving personally identifiable information: (a) A process to determine if notice to individuals or other organizations, including oversight organizations, is needed; (b) An
IR-09 Information Spillage Response Respond to information spills by: a. Assigning [Assignment: personnel or roles] with responsibility for responding to information spills; b. Identifying the specific information involved in the system contamination; c. Alerting [Assignment:
IR-09(01)
in IR-9
 Responsible Personnel withdrawn
IR-09(02)
in IR-9
 Training Provide information spillage response training [Assignment: frequency].
IR-09(03)
in IR-9
 Post-spill Operations Implement the following procedures to ensure that organizational personnel impacted by information spills can continue to carry out assigned tasks while contaminated systems are undergoing corrective actions: [Assignment: procedures].
IR-09(04)
in IR-9
 Exposure to Unauthorized Personnel Employ the following controls for personnel exposed to information not within assigned access authorizations: [Assignment: controls].
IR-10 Integrated Information Security Analysis Team withdrawn

42 of 1196.