The organization: a. Develops, documents, and disseminates to {{ insert: param, ir-1_prm_1 }}: 1. An incident response policy that addresses purpose, scope, roles, responsibilities, managemen...

The organization provides incident response training to information system users consistent with assigned roles and responsibilities: a. Within {{ insert: param, ir-2_prm_1 }} of assuming an inci...

The organization incorporates simulated events into incident response training to facilitate effective response by personnel in crisis situations.

The organization employs automated mechanisms to provide a more thorough and realistic incident response training environment.

The organization tests the incident response capability for the information system {{ insert: param, ir-3_prm_1 }} using {{ insert: param, ir-3_prm_2 }} to determine the incident response effective...

The organization employs automated mechanisms to more thoroughly and effectively test the incident response capability.

The organization coordinates incident response testing with organizational elements responsible for related plans.

The organization: a. Implements an incident handling capability for security incidents that includes preparation, detection and analysis, containment, eradication, and recovery; b. Coordinates ...

The organization employs automated mechanisms to support the incident handling process.

The organization includes dynamic reconfiguration of {{ insert: param, ir-4.2_prm_1 }} as part of the incident response capability.

The organization identifies {{ insert: param, ir-4.3_prm_1 }} and {{ insert: param, ir-4.3_prm_2 }} to ensure continuation of organizational missions and business functions.

The organization correlates incident information and individual incident responses to achieve an organization-wide perspective on incident awareness and response.

The organization implements a configurable capability to automatically disable the information system if {{ insert: param, ir-4.5_prm_1 }} are detected.

The organization implements incident handling capability for insider threats.

The organization coordinates incident handling capability for insider threats across {{ insert: param, ir-4.7_prm_1 }}.

The organization coordinates with {{ insert: param, ir-4.8_prm_1 }} to correlate and share {{ insert: param, ir-4.8_prm_2 }} to achieve a cross-organization perspective on incident awareness and mo...

The organization employs {{ insert: param, ir-4.9_prm_1 }} to effectively respond to security incidents.

The organization coordinates incident handling activities involving supply chain events with other organizations involved in the supply chain.

The organization tracks and documents information system security incidents.

The organization employs automated mechanisms to assist in the tracking of security incidents and in the collection and analysis of incident information.

The organization: a. Requires personnel to report suspected security incidents to the organizational incident response capability within {{ insert: param, ir-6_prm_1 }}; and b. Reports security...

The organization employs automated mechanisms to assist in the reporting of security incidents.

The organization reports information system vulnerabilities associated with reported security incidents to {{ insert: param, ir-6.2_prm_1 }}.

The organization provides security incident information to other organizations involved in the supply chain for information systems or information system components related to the incident.

The organization provides an incident response support resource, integral to the organizational incident response capability that offers advice and assistance to users of the information system for...

The organization employs automated mechanisms to increase the availability of incident response-related information and support.

The organization: (a) Establishes a direct, cooperative relationship between its incident response capability and external providers of information system protection capability; and (b) Identif...

The organization: a. Develops an incident response plan that: 1. Provides the organization with a roadmap for implementing its incident response capability; 2. Describes the structure and...

The organization responds to information spills by: a. Identifying the specific information involved in the information system contamination; b. Alerting {{ insert: param, ir-9_prm_1 }} of the ...

The organization assigns {{ insert: param, ir-9.1_prm_1 }} with responsibility for responding to information spills.

The organization provides information spillage response training {{ insert: param, ir-9.2_prm_1 }}.

The organization implements {{ insert: param, ir-9.3_prm_1 }} to ensure that organizational personnel impacted by information spills can continue to carry out assigned tasks while contaminated syst...

The organization employs {{ insert: param, ir-9.4_prm_1 }} for personnel exposed to information not within assigned access authorizations.

The organization establishes an integrated team of forensic/malicious code analysts, tool developers, and real-time operations personnel.