IR-7—Incident Response Assistance
LI-SaaS
Low
Moderate
High
>Control Description
Provide an incident response support resource, integral to the organizational incident response capability, that offers advice and assistance to users of the system for the handling and reporting of incidents.
>FedRAMP Baseline Requirements
No FedRAMP-specific parameter values or requirements for this baseline.
>Discussion
Incident response support resources provided by organizations include help desks, assistance groups, automated ticketing systems to open and track incident response tickets, and access to forensics services or consumer redress services, when required.
>Cross-Framework Mappings
>Programmatic Queries
Beta
Related Services
AWS Support
AWS Trusted Advisor
AWS Incident Detection and Response
CLI Commands
Check AWS Support plan level
aws support describe-severity-levelsList open support cases
aws support describe-cases --include-resolved-cases falseCreate a security-related support case
aws support create-case --subject 'Security Incident Assistance' --category-code 'security' --severity-code 'urgent' --communication-body 'Requesting IR assistance' --service-code 'general-info'List Trusted Advisor security checks
aws support describe-trusted-advisor-checks --language en --query 'checks[?category==`security`]'>Assessment Interview Topics
Questions assessors commonly ask
Process & Governance:
- •What formal policies and procedures govern the implementation of IR-7 (Incident Response Assistance)?
- •Who are the designated roles responsible for implementing, maintaining, and monitoring IR-7?
- •How frequently is the IR-7 policy reviewed and updated, and what triggers policy changes?
- •What governance structure ensures IR-7 requirements are consistently applied across all systems?
Technical Implementation:
- •Describe the specific technical mechanisms or controls used to enforce IR-7 requirements.
- •What automated tools, systems, or technologies are deployed to implement IR-7?
- •How is IR-7 integrated into your system architecture and overall security posture?
- •What configuration settings, parameters, or technical specifications enforce IR-7 requirements?
Evidence & Documentation:
- •What documentation demonstrates the complete implementation of IR-7?
- •What audit logs, records, reports, or monitoring data validate IR-7 compliance?
- •Can you provide evidence of periodic reviews, assessments, or testing of IR-7 effectiveness?
- •What artifacts would you present during a FedRAMP assessment to demonstrate IR-7 compliance?
Ask AI
Configure your API key to use AI features.