id: "IR-05(01)" title: "Automated Tracking, Data Collection, and Analysis" family: "IR" family_name: "Incident Response" sort_id: "ir-05.01" priority: "P2" implementation_level: "organization" parent: "IR-05" enhancement: True
Statement
Track incidents and collect and analyze incident information using {{ insert: param, ir-5.1_prm_1 }}.
Guidance
Automated mechanisms for tracking incidents and collecting and analyzing incident information include Computer Incident Response Centers or other electronic databases of incidents and network monitoring devices.
Assessment Objective: incidents are tracked using {{ insert: param, ir-05.01_odp.01 }};
Assessment Objective: incident information is collected using {{ insert: param, ir-05.01_odp.02 }};
Assessment Objective: incident information is analyzed using {{ insert: param, ir-05.01_odp.03 }}.
Incident response policy
procedures addressing incident monitoring
incident response records and documentation
system security plan
incident response plan
other relevant documents or records
Organizational personnel with incident monitoring responsibilities
organizational personnel with information security responsibilities
Incident monitoring capability for the organization
automated mechanisms supporting and/or implementing the tracking and documenting of system security incidents