National Vulnerability Database

National Vulnerability Database

National Vulnerability
Database

NIST Special Publication 800-53 (Rev. 4)

Security Controls and Assessment Procedures for Federal Information Systems and Organizations

IR-5 INCIDENT MONITORING

Family:
IR - INCIDENT RESPONSE
Class:
Priority:
P1 - Implement P1 security controls first.
Baseline Allocation:
Low Moderate High
IR-5 IR-5 IR-5 (1)

Control Description

The organization tracks and documents information system security incidents.

Supplemental Guidance

Documenting information system security incidents includes, for example, maintaining records about each incident, the status of the incident, and other pertinent information necessary for forensics, evaluating incident details, trends, and handling. Incident information can be obtained from a variety of sources including, for example, incident reports, incident response teams, audit monitoring, network monitoring, physical access monitoring, and user/administrator reports.

Related to: AU-6IR-8PE-6SC-5SC-7SI-3SI-4SI-7

Control Enhancements

IR-5(1) INCIDENT MONITORING | AUTOMATED TRACKING / DATA COLLECTION / ANALYSIS
The organization employs automated mechanisms to assist in the tracking of security incidents and in the collection and analysis of incident information.
Supplemental Guidance: Automated mechanisms for tracking security incidents and collecting/analyzing incident information include, for example, the Einstein network monitoring device and monitoring online Computer Incident Response Centers (CIRCs) or other electronic databases of incidents.
Related to: AU-7IR-4

References

NIST Special Publication 800-61 https://csrc.nist.gov/publications/search?keywords-lg=800-61