IR — Incident Response
24 controls in the Incident Response family
IR-1Policy and Procedures
LI-SaaS
LOW
MODERATE
HIGH
IR-2Incident Response Training
LI-SaaS
LOW
MODERATE
HIGH
IR-2 (01)Incident Response Training | Simulated Events
HIGH
IR-2 (02)Incident Response Training | Automated Training Environments
HIGH
IR-3Incident Response Testing
MODERATE
HIGH
IR-3 (02)Incident Response Testing | Coordination with Related Plans
MODERATE
HIGH
IR-4Incident Handling
LI-SaaS
LOW
MODERATE
HIGH
IR-4 (01)Incident Handling | Automated Incident Handling Processes
MODERATE
HIGH
IR-4 (02)Incident Handling | Dynamic Reconfiguration
HIGH
IR-4 (04)Incident Handling | Information Correlation
HIGH
IR-4 (06)Incident Handling | Insider Threats
HIGH
IR-4 (11)Incident Handling | Integrated Incident Response Team
HIGH
IR-5Incident Monitoring
LI-SaaS
LOW
MODERATE
HIGH
IR-5 (01)Incident Monitoring | Automated Tracking, Data Collection, and Analysis
HIGH
IR-6Incident Reporting
LI-SaaS
LOW
MODERATE
HIGH
IR-6 (01)Incident Reporting | Automated Reporting
MODERATE
HIGH
IR-6 (03)Incident Reporting | Supply Chain Coordination
MODERATE
HIGH
IR-7Incident Response Assistance
LI-SaaS
LOW
MODERATE
HIGH
IR-7 (01)Incident Response Assistance | Automation Support for Availability of Information and Support
MODERATE
HIGH
IR-8Incident Response Plan
LI-SaaS
LOW
MODERATE
HIGH
IR-9Information Spillage Response
MODERATE
HIGH
IR-9 (02)Information Spillage Response | Training
MODERATE
HIGH
IR-9 (03)Information Spillage Response | Post-spill Operations
MODERATE
HIGH
IR-9 (04)Information Spillage Response | Exposure to Unauthorized Personnel
MODERATE
HIGH