IR-4 — Incident Handling | Defense Map

NIST SP 800-53 control context

IR-4 — Incident Handling

Organizations recognize that incident response capabilities are dependent on the capabilities of organizational systems and the mission and business processes being supported by those systems. Organizations consider incident response as part of the definition, design, and development of mission and business processes and systems. Incident-related information can be obtained from a variety of sources, including audit monitoring, physical access monitoring, and network monitoring; user or administrator reports; and reported supply chain events. An effective incident handling capability includes coordination among many organizational entities (e.g., mission or business owners, system owners, authorizing officials, human resources offices, physical security offices, personnel security offices, legal departments, risk executive [function], operations personnel, procurement offices). Suspected

Read the official statement, discussion, parameters, enhancements, and assessment methods →

Outcome layer

NIST CSF 2.0 informative references

These CSF Subcategories list this base control or one of its enhancements in the imported NIST informative reference.

DE.AE-02Analyze Potentially Adverse EventsIR-4 DE.AE-03Correlate Information from Multiple SourcesIR-4 DE.AE-06Provide Event Information to Authorized Staff and ToolsIR-4 DE.AE-08Declare Incidents Using Defined CriteriaIR-4 ID.IM-01Improvements from EvaluationsIR-4 ID.IM-02Improvements from Tests and ExercisesIR-4 ID.IM-03Improvements from OperationsIR-4 RC.CO-03Communicate Recovery ProgressIR-4 RC.CO-04Share Public Recovery UpdatesIR-4 RC.RP-01Execute the Recovery PlanIR-4 RC.RP-02Select and Perform Recovery ActionsIR-4 RC.RP-06Declare the End of RecoveryIR-4

Show 12 additional relationships

RS.AN-03Establish Incident Facts and Root CauseIR-4 RS.AN-06Preserve Investigation Action RecordsIR-4 RS.AN-07Preserve Incident Data and MetadataIR-4 RS.AN-08Estimate and Validate Incident MagnitudeIR-4 RS.CO-02Notify StakeholdersIR-4 RS.CO-03Share Incident InformationIR-4 RS.MA-02Triage and Validate Incident ReportsIR-4 RS.MA-03Categorize and Prioritize IncidentsIR-4 RS.MA-04Escalate or Elevate IncidentsIR-4 RS.MA-05Apply Recovery Initiation CriteriaIR-4 RS.MI-01Contain IncidentsIR-4 RS.MI-02Eradicate IncidentsIR-4

CUI protection layer

NIST SP 800-171 and SP 800-172

SP 800-171 requirements sourcing this control

03.06.01Incident HandlingIR-4

SP 800-172 enhanced requirements sourcing this control

03.06.01ESecurity Operations CenterIR-4(14)03.06.02EIntegrated Incident Response TeamIR-4(11)03.06.03EBehavior AnalysisIR-4(13)

Defensive engineering layer

MITRE D3FEND techniques

D3-DADynamic Analysisrelated · IR-4(12)D3-DEDecoy Environmentrelated · IR-4(13)D3-DODecoy Objectrelated · IR-4(13)

Adversary layer

MITRE ATT&CK relationships

Curated mitigation mappings

M1048Application Isolation and SandboxingCurated through D3-DA M1056Pre-compromiseCurated through D3-DE M1056Pre-compromiseCurated through D3-DO

Inferred behavior relationships

Experimental: These relationships are inferred through D3FEND and must be validated against architecture, telemetry, and threat context.

Show 152 additional relationships

T1053.004LaunchdInferred through D3-DO

T1055.001Dynamic-link Library InjectionInferred through D3-DO T1055.002Portable Executable InjectionInferred through D3-DO T1055.003Thread Execution HijackingInferred through D3-DA T1055.003Thread Execution HijackingInferred through D3-DO T1055.009Proc MemoryInferred through D3-DO T1055.014VDSO HijackingInferred through D3-DO T1059Command and Scripting InterpreterInferred through D3-DA T1059Command and Scripting InterpreterInferred through D3-DO

T1070.002Clear Linux or Mac System LogsInferred through D3-DO

T1142KeychainInferred through D3-DO

T1547.011Plist ModificationInferred through D3-DO

T1562.003Impair Command History LoggingInferred through D3-DA

T1562.003Impair Command History LoggingInferred through D3-DO

T1574.002DLL Side-LoadingInferred through D3-DO

Relationship boundaries

Use the map without overclaiming.

A CSF informative reference is not an equivalence statement. A source-control relationship is not proof of implementation. A D3FEND semantic relationship is not a product claim. An inferred ATT&CK link is a hypothesis for engineering analysis.

Bare Metal Cyber is an independent educational publisher and is not affiliated with or endorsed by NIST or MITRE. Informative references and cross-framework relationships support navigation and analysis; they do not establish compliance, applicability, equivalence, control inheritance, or guaranteed mitigation effectiveness.