Control statement
Provide an incident response support resource, integral to the organizational incident response capability, that offers advice and assistance to users of the system for the handling and reporting of incidents.
Discussion
Incident response support resources provided by organizations include help desks, assistance groups, automated ticketing systems to open and track incident response tickets, and access to forensics services or consumer redress services, when required.
From control text to operational evidence
Use Incident Response Assistance as a testable risk decision. Translate the official statement into accountable people, repeatable processes, configured technology, and evidence that demonstrates the outcome over time. In this family, pay particular attention to prepared detection, coordinated response, analysis, reporting, and lessons learned.
Implementation workflow
- Define the control boundary, responsible owner, inherited portions, and systems or processes in scope.
- Resolve each organization-defined parameter before declaring the control implemented.
- Document how the implementation satisfies every clause of the official control statement.
- Collect evidence as a normal byproduct of operation rather than only before an assessment.
- Review exceptions, changes, and monitoring results on a risk-based cadence.
Evidence examples
- incident response plans and playbooks
- case records and timelines
- exercise and tabletop results
- lessons-learned and corrective-action tracking
Common failure patterns
- plans that do not match current architecture
- unclear authority for containment decisions
- evidence lost during response
- lessons learned recorded but not implemented
Questions practitioners should ask
- What risk decision is this control intended to support in this system?
- Which parts are implemented locally, inherited, shared, or not applicable—and what evidence supports that decision?
- Do the documented narrative, deployed configuration, operating process, and collected evidence agree?
- What event or threshold requires the implementation to be reviewed or changed?
Assessment objectives and methods
Show the assessment objective
- IR-07[01]an incident response support resource, integral to the organizational incident response capability, is provided;
- IR-07[02]the incident response support resource offers advice and assistance to users of the system for the response and reporting of incidents.
Examine
- Incident response policy
- procedures addressing incident response assistance
- incident response plan
- system security plan
- privacy plan
- other relevant documents or records
Interview
- Organizational personnel with incident response assistance and support responsibilities
- organizational personnel with access to incident response support and assistance capability
- organizational personnel with information security and privacy responsibilities
Test
- Organizational processes for incident response assistance
- mechanisms supporting and/or implementing incident response assistance
Related controls
These relationships come from the official OSCAL catalog. They indicate useful dependencies or context, not automatic inheritance or equivalence.
Control enhancements
Enhancements add specificity, strength, or scope to the base control. Baseline badges show explicit selections in the official SP 800-53B OSCAL profiles.
IR-7(1) — Automation Support for Availability of Information and Support
Increase the availability of incident response information and support using [Organization-defined: automated mechanisms].
Official discussion
Automated mechanisms can provide a push or pull capability for users to obtain incident response assistance. For example, individuals may have access to a website to query the assistance capability, or the assistance capability can proactively send incident response information to users (general distribution or targeted) as part of increasing understanding of current response capabilities and support.
Organization-defined parameters (1)
Assessment objectives and methods
the availability of incident response information and support is increased using [Organization-defined: automated mechanisms].
Examine
- Incident response policy
- procedures addressing incident response assistance
- automated mechanisms supporting incident response support and assistance
- system design documentation
- system configuration settings and associated documentation
- incident response plan
- system security plan
- other relevant documents or records
Interview
- Organizational personnel with incident response support and assistance responsibilities
- organizational personnel with access to incident response support and assistance capability
- organizational personnel with information security responsibilities
Test
- Organizational processes for incident response assistance
- automated mechanisms supporting and/or implementing an increase in the availability of incident response information and support
IR-7(2) — Coordination with External Providers
- (a)Establish a direct, cooperative relationship between its incident response capability and external providers of system protection capability; and
- (b)Identify organizational incident response team members to the external providers.
Official discussion
External providers of a system protection capability include the Computer Network Defense program within the U.S. Department of Defense. External providers help to protect, monitor, analyze, detect, and respond to unauthorized activity within organizational information systems and networks. It may be beneficial to have agreements in place with external providers to clarify the roles and responsibilities of each party before an incident occurs.
Assessment objectives and methods
- IR-07(02)(a)a direct, cooperative relationship is established between its incident response capability and external providers of the system protection capability;
- IR-07(02)(b)organizational incident response team members are identified to the external providers.
Examine
- Incident response policy
- procedures addressing incident response assistance
- incident response plan
- system security plan
- privacy plan
- other relevant documents or records
Interview
- Organizational personnel with incident response support and assistance responsibilities
- external providers of system protection capability
- organizational personnel with information security and privacy responsibilities
Authoritative sources
Bare Metal Cyber is an independent educational publisher and is not affiliated with or endorsed by NIST. Official control requirements and interpretations remain with NIST and the responsible authorizing organization.