Navigate

IR-5 (1)

IR-5 (1): Automated Tracking / Data Collection / Analysis

The organization employs automated mechanisms to assist in the tracking of security incidents and in the collection and analysis of incident information.

Supplemental

Automated mechanisms for tracking security incidents and collecting/analyzing incident information include, for example, the Einstein network monitoring device and monitoring online Computer Incident Response Centers (CIRCs) or other electronic databases of incidents.

CIA Levels
Confidentiality	high
Integrity	high
Availability	high

Overlays
Int-A, Int-B, Int-C

Related Controls

The controls below (if any) were marked by NIST as being related to IR-5 (1).

Control	Description
AU-7	The information system provides an audit reduction and report generation capability that: AU-7a.: Supports on-demand audit review, analysis, and reporting requirements and after-the-fact investigations of security incidents; and AU-7b.: Does not alter the original content or time ordering of audit records.
IR-4	The organization: IR-4a.: Implements an incident handling capability for security incidents that includes preparation, detection and analysis, containment, eradication, and recovery; IR-4b.: Coordinates incident handling activities with contingency planning activities; and IR-4c.: Incorporates lessons learned from ongoing incident handling activities into incident response procedures, training, and testing, and implements the resulting changes accordingly.

Control

Description

AU-7

The information system provides an audit reduction and report generation capability that:

AU-7a.: Supports on-demand audit review, analysis, and reporting requirements and after-the-fact investigations of security incidents; and

AU-7b.: Does not alter the original content or time ordering of audit records.

IR-4

The organization:

IR-4a.: Implements an incident handling capability for security incidents that includes preparation, detection and analysis, containment, eradication, and recovery;

IR-4b.: Coordinates incident handling activities with contingency planning activities; and

IR-4c.: Incorporates lessons learned from ongoing incident handling activities into incident response procedures, training, and testing, and implements the resulting changes accordingly.

Enhancements

The controls below (if any) add on to the requirements of IR-5 (1).

Control	Description
No controls

Related CCIs

The CCIs below are tied to IR-5 (1).

CCI	Definition
CCI-000833	The organization employs automated mechanisms to assist in the tracking of security incidents.
CCI-001626	The organization employs automated mechanisms to assist in the collection of security incident information.
CCI-001627	The organization employs automated mechanisms to assist in the analysis of security incident information.