Navigate

IR-8

IR-8: Incident Response Plan

The organization:

IR-8a.: Develops an incident response plan that:
- IR-8a.1.: Provides the organization with a roadmap for implementing its incident response capability;
- IR-8a.2.: Describes the structure and organization of the incident response capability;
- IR-8a.3.: Provides a high-level approach for how the incident response capability fits into the overall organization;
- IR-8a.4.: Meets the unique requirements of the organization, which relate to mission, size, structure, and functions;
- IR-8a.5.: Defines reportable incidents;
- IR-8a.6.: Provides metrics for measuring the incident response capability within the organization;
- IR-8a.7.: Defines the resources and management support needed to effectively maintain and mature an incident response capability; and
- IR-8a.8.: Is reviewed and approved by [Assignment: organization-defined personnel or roles];

IR-8b.: Distributes copies of the incident response plan to [Assignment: organization-defined incident response personnel (identified by name and/or by role) and organizational elements];

IR-8c.: Reviews the incident response plan [Assignment: organization-defined frequency];

IR-8d.: Updates the incident response plan to address system/organizational changes or problems encountered during plan implementation, execution, or testing;

IR-8e.: Communicates incident response plan changes to [Assignment: organization-defined incident response personnel (identified by name and/or by role) and organizational elements]; and

IR-8f.: Protects the incident response plan from unauthorized disclosure and modification.

Supplemental

It is important that organizations develop and implement a coordinated approach to incident response. Organizational missions, business functions, strategies, goals, and objectives for incident response help to determine the structure of incident response capabilities. As part of a comprehensive incident response capability, organizations consider the coordination and sharing of information with external organizations, including, for example, external service providers and organizations involved in the supply chain for organizational information systems.

CIA Levels
Confidentiality	low
Integrity	low
Availability	low

Overlays
Privacy (High), Privacy (Low), Privacy (Mod), Privacy (PHI)

Related Controls

The controls below (if any) were marked by NIST as being related to IR-8.

Control	Description
MP-2	The organization restricts access to [Assignment: organization-defined types of digital and/or non-digital media] to [Assignment: organization-defined personnel or roles].
MP-4	The organization: MP-4a.: Physically controls and securely stores [Assignment: organization-defined types of digital and/or non-digital media] within [Assignment: organization-defined controlled areas]; and MP-4b.: Protects information system media until the media are destroyed or sanitized using approved equipment, techniques, and procedures.
MP-5	The organization: MP-5a.: Protects and controls [Assignment: organization-defined types of information system media] during transport outside of controlled areas using [Assignment: organization-defined security safeguards]; MP-5b.: Maintains accountability for information system media during transport outside of controlled areas; MP-5c.: Documents activities associated with the transport of information system media; and MP-5d.: Restricts the activities associated with the transport of information system media to authorized personnel.

Enhancements

The controls below (if any) add on to the requirements of IR-8.

Control	Description
No controls

Related CCIs

The CCIs below are tied to IR-8.

CCI	Definition
CCI-000844	The organization develops an incident response plan that is reviewed and approved by organization-defined personnel or roles.
CCI-000845	The organization defines incident response personnel (identified by name and/or by role) and organizational elements to whom copies of the incident response plan are distributed.
CCI-000846	The organization distributes copies of the incident response plan to organization-defined incident response personnel (identified by name and/or by role) and organizational elements.
CCI-000847	The organization defines the frequency for reviewing the incident response plan.
CCI-000848	The organization reviews the incident response plan on an organization-defined frequency.
CCI-000849	The organization updates the incident response plan to address system/organizational changes or problems encountered during plan implementation, execution, or testing.
CCI-000850	The organization communicates incident response plan changes to organization-defined incident response personnel (identified by name and/or by role) and organizational elements.
CCI-002794	The organization develops an incident response plan.
CCI-002795	The organization^s incident response plan provides the organization with a roadmap for implementing its incident response capability.
CCI-002796	The organization^s incident response plan describes the structure and organization of the incident response capability.
CCI-002797	The organization^s incident response plan provides a high-level approach for how the incident response capability fits into the overall organization.
CCI-002798	The organization^s incident response plan meets the unique requirements of the organization, which relate to mission, size, structure, and functions.
CCI-002799	The organization^s incident response plan defines reportable incidents.
CCI-002800	The organization^s incident response plan provides metrics for measuring the incident response capability within the organization.
CCI-002801	The organization^s incident response plan defines the resources and management support needed to effectively maintain and mature an incident response capability.
CCI-002802	The organization defines personnel or roles to review and approve the incident response plan.
CCI-002803	The organization defines incident response personnel (identified by name and/or by role) and organizational elements to whom incident response plan changes will be communicated.
CCI-002804	The organization protects the incident response plan from unauthorized disclosure and modification.