FedRAMP Rev 5 C.8: C.8 Incident communications

FedRAMP requires providers to report every suspected or confirmed incident resulting in actual or potential loss of confidentiality, integrity or availability of the service, including impact to federal customer data, within one hour of identification by the provider's top-level CSIRT, SOC or IT department, to impacted or possibly impacted customers through the incident folder of the secure repository, to CISA through its reporting form where the incident matches or may match the CISA attack vectors, to FedRAMP at its security mailbox, and to agency AOs, representatives and incident response teams; the CISA tracking number is passed to all points of contact as soon as issued, verbal notifications are followed by email, sensitive information is protected through approved mechanisms, contact information for all points of contact is kept current, automated reporting may be used once agreed with the AO and FedRAMP, updates go to CISA and daily to all points of contact until recovery is complete, and a final report after post-incident activity describes what occurred, the root cause, the response, lessons learned and changes needed. Providers respond to emergency inquiries from FedRAMP, including those arising from CISA Emergency Directives, within the timelines set; reporting is not punitive but failure to report leads to escalation. Agency AOs verify CISA notification, request daily updates and the tracking number, verify the posting in the repository, notify the provider, CISA and FedRAMP of incidents they learn of first, and evaluate the final report.