FedRAMP Moderate Compliance Checklist for: (IR) Incident Response Control Family

The Incident Response (IR) control family establishes the policies, procedures, and capabilities necessary to prepare for, detect, respond to, and recover from security incidents. These controls ensure organizations can effectively handle security events through a structured approach that includes incident prevention, detection and analysis, containment, eradication, and recovery. The family emphasizes the importance of maintaining trained incident response personnel, conducting regular testing, implementing automated incident management tools, and reporting incidents to appropriate authorities in accordance with federal guidelines. By implementing these controls, organizations create a consistent, predictable, and effective incident response capability that minimizes the impact of security incidents and supports continuous improvement through lessons learned.

Security controls are written in a way that's unnecessarily complex and difficult to understand. We took the time to simplify the FedRAMP Moderate security controls so you don't have to. Here's a straightforward list of everything you need to do to implement the IR family:

Policy and Documentation

• IR-01: Develop organization-wide incident response policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance
• IR-01: Ensure incident response policy is consistent with applicable laws, executive orders, directives, regulations, policies, standards, and guidelines
• IR-01: Document procedures to facilitate implementation of the incident response policy and associated controls
• IR-01: Disseminate incident response policy and procedures to organization-defined personnel or roles
• IR-01: Designate the ISSO or equivalent to manage the development, documentation, and dissemination of the incident response policy and procedures
• IR-01: Review and update incident response policy at least every 3 years or when changes occur
• IR-01: Review and update incident response procedures at least annually or when changes occur
• IR-08: Develop an incident response plan that provides the organization with a roadmap for implementing its incident response capability
• IR-08: Describe the structure and organization of the incident response capability in the plan
• IR-08: Provide a high-level approach for how the incident response capability fits into the overall organization
• IR-08: Ensure the incident response plan meets the unique requirements of the organization related to mission, size, structure, and functions
• IR-08: Define reportable incidents in the incident response plan
• IR-08: Provide metrics for measuring the incident response capability within the organization
• IR-08: Define the resources and management support needed to effectively maintain and mature an incident response capability
• IR-08: Address the sharing of incident information in the incident response plan
• IR-08: Have the incident response plan reviewed and approved by the ISSO or equivalent at least every 3 years or when changes occur
• IR-08: Explicitly designate responsibility for incident response to the ISSO or equivalent
• IR-08: Distribute copies of the incident response plan to the incident response team and those with incident response roles and responsibilities
• IR-08: Update the incident response plan to address system and organizational changes or problems encountered during plan implementation, execution, or testing
• IR-08: Communicate incident response plan changes to the incident response team and those with incident response roles and responsibilities
• IR-08: Protect the incident response plan from unauthorized disclosure and modification

Training and Testing

• IR-02: Provide incident response training to system users consistent with assigned roles and responsibilities within 10 days of assuming an incident response role or responsibility or acquiring system access
• IR-02: Provide incident response training when required by system changes
• IR-02: Provide incident response training at least annually to personnel with incident response roles and responsibilities
• IR-02: Review and update incident response training content at least annually or when changes occur
• IR-03: Test the effectiveness of the incident response capability for the system at least annually using test scenarios based on current threat information
• IR-03(02): Coordinate incident response testing with organizational elements responsible for related plans

Incident Handling and Response

• IR-04: Implement an incident handling capability for incidents that is consistent with the incident response plan and includes preparation, detection and analysis, containment, eradication, and recovery
• IR-04: Coordinate incident handling activities with contingency planning activities
• IR-04: Incorporate lessons learned from ongoing incident handling activities into incident response procedures, training, and testing, and implement the resulting changes accordingly
• IR-04: Ensure the rigor, intensity, scope, and results of incident handling activities are comparable and predictable across the organization
• IR-04(01): Support the incident handling process using an online incident management system
• IR-05: Track and document incidents
• IR-07: Provide an incident response support resource, integral to the organizational incident response capability, that offers advice and assistance to users of the system for the handling and reporting of incidents
• IR-07(01): Increase the availability of incident response information and support using automated mechanisms for real-time support

Incident Reporting

• IR-06: Require personnel to report suspected incidents to the organizational incident response capability within US-CERT incident reporting timelines as specified in the US-CERT Federal Incident Notification Guidelines
• IR-06: Report incident information to US-CERT and other organization-defined personnel or roles
• IR-06(01): Report incidents using automated mechanisms supporting reporting of incidents
• IR-06(03): Provide incident information to the provider of the product or service and other organizations involved in the supply chain or supply chain governance for systems or system components related to the incident