Security requirement
- a.Track and document system security incidents.
- b.Report suspected incidents to the organizational incident response capability within [Organization-defined: time period].
- c.Report incident information to [Organization-defined: authorities].
- d.Provide an incident response support resource that offers advice and assistance to system users on handling and reporting incidents.
Discussion
Documenting incidents includes maintaining records about each incident, the status of the incident, and other pertinent information necessary for forensics as well as evaluating incident details, trends, and handling. Incident information can be obtained from many sources, including network monitoring, incident reports, incident response teams, user complaints, supply chain partners, audit monitoring, physical access monitoring, and user and administrator reports. 03.06.01 provides information on the types of incidents that are appropriate for monitoring. The types of incidents reported, the content and timeliness of the reports, and the reporting authorities reflect applicable laws, Executive Orders, directives, regulations, policies, standards, and guidelines. Incident information informs risk assessments, the effectiveness of security assessments, the security requirements for acquisitions, and the selection criteria for technology products. Incident response support resources provided by organizations include help desks, assistance groups, automated ticketing systems to open and track incident response tickets, and access to forensic services or consumer redress services, when required.
Tailoring decisions required
Resolve these values through the governing organization’s approved tailoring and risk-management process before declaring the requirement implemented.
Implementation perspective
Treat Incident Monitoring, Reporting, and Response Assistance as a CUI protection outcome that must be reflected in the system boundary, documented implementation, operational behavior, and assessment evidence. Pay particular attention to prepared detection, coordinated response, reporting, recovery, and lessons learned for incidents involving CUI.
- Confirm the requirement is in scope for the CUI system components, services, users, and external connections being assessed.
- Resolve every organization-defined parameter through an approved governance and tailoring process.
- Map each clause of the requirement to an accountable owner, implementation mechanism, and evidence source.
- Verify that inherited and shared implementations are supported by current provider evidence and responsibility boundaries.
- Collect evidence during normal operation and review changes, exceptions, and deficiencies on a risk-based cadence.
Questions to ask
- Which CUI assets, data flows, users, and services are protected by this requirement?
- Which portions are implemented locally, inherited, shared, or not applicable, and what evidence supports that determination?
- Do the system security plan, deployed configuration, operating process, and assessment evidence tell the same story?
- What change, incident, or threshold should trigger reassessment?
Evidence and validation
- incident response plans and playbooks
- case records and timelines
- exercise and tabletop results
- lessons-learned and corrective-action tracking
Common failure patterns
- plans that do not match the current architecture
- unclear authority for containment decisions
- evidence lost during response
- lessons learned recorded but not implemented
Assessment objectives and methods
Assessment objectives (5)
- a.
system security incidents are tracked.
- a.
system security incidents are documented.
- b.
suspected incidents are reported to the organizational incident response capability within [Organization-defined: time period].
- c.
incident information is reported to [Organization-defined: authorities].
- d.
an incident response support resource that offers advice and assistance to system users on handling and reporting incidents is provided.
Examine
- incident response policy and procedures
- procedures for incident monitoring
- procedures for incident response assistance
- incident response records and documentation
- incident response plan
- system security plan
- other relevant documents or records
Interview
- personnel with incident monitoring responsibilities
- personnel with incident response assistance and support responsibilities
- personnel with information security responsibilities
Test
- processes for incident reporting
- incident monitoring capability
- mechanisms for supporting or implementing the tracking and documenting of system security incidents
- mechanisms for supporting or implementing incident reporting
- mechanisms for supporting or implementing incident response assistance
- processes for incident response assistance
Source NIST SP 800-53 controls
These controls are referenced by the official SP 800-171 Rev. 3 OSCAL record. Open the corresponding control pages for complete control text, enhancements, D3FEND mappings, and related learning.
Authoritative sources
- NIST SP 800-171 Revision 3 official publication ↗
- NIST SP 800-171A Revision 3 official publication ↗
- NIST OSCAL Content release used for this import ↗
Bare Metal Cyber is an independent educational publisher and is not affiliated with or endorsed by NIST. The official publications, the responsible federal agency, and the governing contract or agreement determine applicability, tailoring, assessment depth, and required implementation.