The SP 800-53 Rev. 5 Incident Response family: IR policy, training, testing, handling, monitoring, reporting, assistance, the incident response plan and spillage response, with baselines, assessment procedures and evidence for each control.
The incident response policy and procedures control: what the IR policy must address, who owns it, how often policy and procedures are reviewed and updated, and the documents and interviews assessors use to confirm they are current and disseminated.
Role-based incident response training: when users and responders must be trained (on taking on a role or gaining access, after system changes, and periodically), keeping the training content current, and the training records assessors ask for.
Testing whether the incident response capability works: choosing tests such as tabletop exercises, walk-throughs and simulations, setting a test frequency, and the test plans and after-action results an assessor reviews. Not in the low baseline.
The core incident handling control: a capability covering preparation, detection and analysis, containment, eradication and recovery, coordination with contingency planning, lessons learned, and the case records, playbooks and tooling evidence assessors test. It has the most enhancements in the IR family.
Tracking and documenting every incident: incident records, status tracking and the details needed for forensics and trend analysis, as distinct from handling incidents (IR-4) and reporting them (IR-6).
Incident reporting: how quickly personnel must report suspected incidents to the internal incident response capability, which external authorities receive incident information, and the reporting records and timelines assessors check.
Incident response assistance for system users: help desks, assistance groups, ticketing and access to forensic services that help users handle and report incidents, and how assessors confirm the support resource exists and is reachable.
The incident response plan: its required contents (structure, reportable incidents, metrics, resources, information sharing, designated responsibilities), approval, distribution, updates after changes or lessons learned, and protection of the plan itself.
Responding to information spills, where information lands on a system not authorized to hold it: assigning responders, identifying and isolating contaminated components, eradicating the information and finding further contamination. No baseline includes it.
Tell us what you're working on, whether it's a deployment, an audit, a security test or a cyber range. You'll speak with an engineer who can help you scope it.