1. Home
  2. FedRAMP
  3. IR-6

BRACKETOLOGY | FEDRAMP

IR-6: INCIDENT REPORTING

  • FedRAMP Baseline Membership IR-6:
  • LOW
  • MODERATE
  • HIGH

FedRAMP Bracketology

Use the FedRAMP Control Membership information above to determine if a control or control enhancement is required for each Impact Baseline — LOW, MODERATE, or HIGH

Click on the panel below each control or control enhancement to review the FedRAMP Impact Baseline-specific control configuration requirements for each of the [BRACKETS] in each control and/or control enhancement.

Review and use Additional Requirements and Guidance to build FedRAMP-compliant controls for your risk-based cybersecurity program.

To change the baseline view in the panel, click on LOW, MODERATE, or HIGH when the panel is open

Panels only appear where there are [BRACKETS] in the control or enhancement or where there is FedRAMP-specific requirements or guidance available.

The organization:

    • a. Requires personnel to report suspected security incidents to the organizational incident response capability within [Assignment: organization-defined time period]; and
    • b. Reports security incident information to [Assignment: organization-defined authorities].

Click Low | Moderate | High below to see FedRAMP control configuration information. It's in BOLD.

The organization:

  • a. Requires personnel to report suspected security incidents to the organizational incident response capability within US-CERT incident reporting timelines as specified in NIST SP800-61 (as amended); and
  • b. Reports security incident information to organization-defined authorities.

FedRAMP REQUIREMENT:

Report security incident information according to FedRAMP Incident Communications Procedure.

The organization:

  • a. Requires personnel to report suspected security incidents to the organizational incident response capability within US-CERT incident reporting timelines as specified in NIST SP800-61 (as amended); and
  • b. Reports security incident information to organization-defined authorities.

FedRAMP REQUIREMENT:

Report security incident information according to FedRAMP Incident Communications Procedure.

The organization:

  • a. Requires personnel to report suspected security incidents to the organizational incident response capability within US-CERT incident reporting timelines as specified in NIST SP800-61 (as amended); and
  • b. Reports security incident information to organization-defined authorities.

FedRAMP REQUIREMENT:

Report security incident information according to FedRAMP Incident Communications Procedure.

SUPPLEMENTAL GUIDANCE

The intent of this control is to address both specific incident reporting requirements within an organization and the formal incident reporting requirements for federal agencies and their subordinate organizations. Suspected security incidents include, for example, the receipt of suspicious email communications that can potentially contain malicious code. The types of security incidents reported, the content and timeliness of the reports, and the designated reporting authorities reflect applicable federal laws, Executive Orders, directives, regulations, policies, standards, and guidance. Current federal policy requires that all federal agencies (unless specifically exempted from such requirements) report security incidents to the United States Computer Emergency Readiness Team (US-CERT) within specified time frames designated in the US-CERT Concept of Operations for Federal Cyber Security Incident Handling.

CONTROL ENHANCEMENTS

IR-6 (1) INCIDENT REPORTING | AUTOMATED REPORTING
  • FedRAMP Baseline Membership IR-6 (1):
  • MODERATE
  • HIGH

The organization employs automated mechanisms to assist in the reporting of security incidents.

Supplemental Guidance: NONE

RELATED CONTROLS: IR-6 (1)

IR-6 (2) INCIDENT REPORTING | VULNERABILITIES RELATED TO INCIDENTS

The organization reports information system vulnerabilities associated with reported security incidents to [Assignment: organization-defined personnel or roles].

Supplemental Guidance: NONE

IR-6 (3) INCIDENT REPORTING | COORDINATION WITH SUPPLY CHAIN

The organization provides security incident information to other organizations involved in the supply chain for information systems or information system components related to the incident.

Supplemental Guidance:

Organizations involved in supply chain activities include, for example, system/product developers, integrators, manufacturers, packagers, assemblers, distributors, vendors, and resellers. Supply chain incidents include, for example, compromises/breaches involving information system components, information technology products, development processes or personnel, and distribution processes or warehousing facilities. Organizations determine the appropriate information to share considering the value gained from support by external organizations with the potential for harm due to sensitive information being released to outside organizations of perhaps questionable trustworthiness.

REFERENCES:

  • NIST Special Publication 800-61
  • http://www.us-cert.gov