id: "IR-05" title: "Incident Monitoring" family: "IR" family_name: "Incident Response" sort_id: "ir-05" priority: "P2" implementation_level: "organization" enhancements: - ir-5.1
Statement
Track and document incidents.
Guidance
Documenting incidents includes maintaining records about each incident, the status of the incident, and other pertinent information necessary for forensics as well as evaluating incident details, trends, and handling. Incident information can be obtained from a variety of sources, including network monitoring, incident reports, incident response teams, user complaints, supply chain partners, audit monitoring, physical access monitoring, and user and administrator reports. IR-4 provides information on the types of incidents that are appropriate for monitoring.
Assessment Objective: incidents are tracked;
Assessment Objective: incidents are documented.
Incident response policy
procedures addressing incident monitoring
incident response records and documentation
incident response plan
system security plan
privacy plan
other relevant documents or records
Organizational personnel with incident monitoring responsibilities
organizational personnel with information security and privacy responsibilities
Incident monitoring capability for the organization
mechanisms supporting and/or implementing the tracking and documenting of system security incidents