IR — Incident Response
33 controls in the Incident Response family
IR-1Policy and Procedures
IL4 ModIL4 HighIL5IL6
IR-2Incident Response Training
IL4 ModIL4 HighIL5IL6
IR-2(1)Incident Response Training | Simulated Events
IL4 HighIL5IL6
IR-2(2)Incident Response Training | Automated Training Environments
IL4 HighIL5IL6
IR-3Incident Response Testing
IL4 ModIL4 HighIL5IL6
IR-3(2)Incident Response Testing | Coordination with Related Plans
IL4 ModIL4 HighIL5IL6
IR-4Incident Handling
IL4 ModIL4 HighIL5IL6
IR-4(1)Incident Handling | Automated Incident Handling Processes
IL4 ModIL4 HighIL5IL6
IR-4(2)Incident Handling | Dynamic Reconfiguration
IL4 HighIL5IL6
IR-4(3)Incident Handling | Continuity of Operations
IL5IL6
IR-4(4)Incident Handling | Information Correlation
IL4 HighIL5IL6
IR-4(6)Incident Handling | Insider Threats
IL4 HighIL5IL6
IR-4(7)Incident Handling | Insider Threats -- Intra-organization Coordination
IL5IL6
IR-4(8)Incident Handling | Correlation with External Organizations
IL5IL6
IR-4(10)Incident Handling | Supply Chain Coordination
IL5IL6
IR-4(11)Incident Handling | Integrated Incident Response Team
IL4 HighIL5IL6
IR-4(12)Incident Handling | Malicious Code and Forensic Analysis
IL5IL6
IR-4(13)Incident Handling | Behavior Analysis
IL5IL6
IR-4(14)Incident Handling | Security Operations Center
IL5IL6
IR-5Incident Monitoring
IL4 ModIL4 HighIL5IL6
IR-5(1)Incident Monitoring | Automated Tracking, Data Collection, and Analysis
IL4 HighIL5IL6
IR-6Incident Reporting
IL4 ModIL4 HighIL5IL6
IR-6(1)Incident Reporting | Automated Reporting
IL4 ModIL4 HighIL5IL6
IR-6(2)Incident Reporting | Vulnerabilities Related to Incidents
IL5IL6
IR-6(3)Incident Reporting | Supply Chain Coordination
IL4 ModIL4 HighIL5IL6
IR-7Incident Response Assistance
IL4 ModIL4 HighIL5IL6
IR-7(1)Incident Response Assistance | Automation Support for Availability of Information and Support
IL4 ModIL4 HighIL5IL6
IR-7(2)Incident Response Assistance | Coordination with External Providers
IL5IL6
IR-8Incident Response Plan
IL4 ModIL4 HighIL5IL6
IR-9Information Spillage Response
IL4 ModIL4 HighIL5IL6
IR-9(2)Information Spillage Response | Training
IL4 ModIL4 HighIL5IL6
IR-9(3)Information Spillage Response | Post-spill Operations
IL4 ModIL4 HighIL5IL6
IR-9(4)Information Spillage Response | Exposure to Unauthorized Personnel
IL4 ModIL4 HighIL5IL6