Incident Monitoring IR-5

Overview:
The organization tracks and documents information system security incidents.

Supplemental Guidance:
Documenting information system security incidents includes, for example, maintaining records about each incident, the status of the incident, and other pertinent information necessary for forensics, evaluating incident details, trends, and handling. Incident information can be obtained from a variety of sources including, for example, incident reports, incident response teams, audit monitoring, network monitoring, physical access monitoring, and user/administrator reports.

Related controls:AU-6, IR-8, PE-6, SC-5, SC-7, SI-3, SI-4, SI-7.

Action Items:
1) Ensure all security incidents are logged and tracked

Related Documents:
1) Incident Response Plan

Additional Guidance:
Moderate FedRAMP-Defined Assignment / Selection Parameters
none

Moderate Additional FedRAMP Requirements and Guidance
none